Updated lots of detections to have the correct datamodel. Still missing the required_fields, though but we will get to that.

detections/application/detect_risky_spl_using_pretrained_ml_model.yml

@@ -5,16 +5,31 @@ date: '2022-06-16'
 author: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk
 type: Anomaly
 datamodel:
-- Splunk_Audit
-description: 'The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then the model file is packaged within ESCU for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky. This model is on-prem only.'
-search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type | eval spl_text = 'Search_Activity.search'. \" \" .'Search_Activity.user'. \" \" .'Search_Activity.search_type'| dedup spl_text 
-| apply risky_spl_pre_trained_model 
-| where risk_score > 0.5 
-| `drop_dm_object_name(Search_Activity)` 
-| table search, user, search_type, risk_score 
-| `detect_risky_spl_using_pretrained_ml_model_filter`" 
-how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. The detection uses a custom MLTK model hence we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb.
-known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords.
+- Splunk_Audit.Search_Activity
+description: The following analytic uses a pretrained machine learning text classifier
+  to detect potentially risky commands. The model is trained independently and then
+  the model file is packaged within ESCU for usage. A command is deemed risky based
+  on the presence of certain trigger keywords, along with the context and the role
+  of the user (please see references). The model uses custom features to predict whether
+  a SPL is risky using text classification. The model takes as input the command text,
+  user and search type and outputs a risk score between [0,1]. A high score indicates
+  higher likelihood of a command being risky. This model is on-prem only.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc
+  Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user
+  Search_Activity.search_type | eval spl_text = ''Search_Activity.search''. " " .''Search_Activity.user''.
+  " " .''Search_Activity.search_type''| dedup spl_text | apply risky_spl_pre_trained_model
+  | where risk_score > ''0.5'' | `drop_dm_object_name(Search_Activity)` | table search,
+  user, search_type, risk_score | `detect_risky_spl_using_pretrained_ml_model_filter`'
+how_to_implement: This detection depends on the MLTK app which can be found here -
+  https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can
+  be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need
+  to be ingesting logs which include Search_Activity.search, Search_Activity.user,
+  Search_Activity.search_type from your endpoints. The risk score threshold should
+  be adjusted based on the environment. The detection uses a custom MLTK model hence
+  we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb.
+known_false_positives: False positives may be present if suspicious behavior is observed,
+  as determined by frequent usage of risky keywords.
 references:
 - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
 tags:
@@ -50,9 +65,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Search_Activity.search 
-  - Search_Activity.user 
+  - Search_Activity.search
+  - Search_Activity.user
   - Search_Activity.search_type
   risk_score: 20
   security_domain: audit
-  

detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml

@@ -5,7 +5,7 @@ date: '2020-09-04'
 author: David Dorsey, Splunk
 type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
 description: This search looks for new commands from each user role.
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
   where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user,

detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml

@@ -5,7 +5,7 @@ date: '2021-07-13'
 author: Rico Valdez, Splunk
 type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
 description: This search looks for cloud compute instances created by users who have
   not created them before.
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,

detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml

@@ -5,18 +5,18 @@ date: '2020-09-02'
 author: David Dorsey, Splunk
 type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
 description: This search looks at cloud-infrastructure events where an instance is
   created in any region within the last hour and then compares it to a lookup file
   of previously seen regions where instances have been created.
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id)
-  as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region,
-  All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions
-  vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats
-  max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen)
-  | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(),
-  "-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)`
-  | `cloud_compute_instance_created_in_previously_unused_region_filter`'
+  as dest, count from datamodel=Change.All_Changes where All_Changes.action=created
+  by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")`
+  | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW
+  firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
+  enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion)
+  OR firstTimeSeenRegion > relative_time(now(), "-24h@h") | table firstTime, user,
+  dest, count , vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter`'
 how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
   provider. You should run the baseline search `Previously Seen Cloud Regions - Initial`
   to build the initial table of images observed and times. You must also enable the

detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml

@@ -5,7 +5,7 @@ date: '2020-07-29'
 author: Rico Valdez, Splunk
 type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
 description: This search looks for cloud instances being modified by users who have
   not previously modified them.
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,

detections/cloud/cloud_provisioning_from_previously_unseen_city.yml

@@ -5,7 +5,7 @@ date: '2020-10-09'
 author: Rico Valdez, Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
 description: This search looks for cloud provisioning activities from previously unseen
   cities. Provisioning activities are defined broadly as any event that runs or creates
   something.

detections/cloud/cloud_provisioning_from_previously_unseen_country.yml

@@ -5,7 +5,7 @@ date: '2020-10-09'
 author: Rico Valdez, Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
 description: This search looks for cloud provisioning activities from previously unseen
   countries. Provisioning activities are defined broadly as any event that runs or
   creates something.

detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml

@@ -5,14 +5,14 @@ date: '2020-08-16'
 author: Rico Valdez, Splunk
 type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
 description: This search looks for cloud provisioning activities from previously unseen
   IP addresses. Provisioning activities are defined broadly as any event that runs
   or creates something.
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id)
-  as object_id from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created)
-  All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command
-  | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources
+  as object_id from datamodel=Change.All_Changes where (All_Changes.action=started
+  OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user,
+  All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources
   src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data
   | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc)
   OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)

detections/cloud/cloud_provisioning_from_previously_unseen_region.yml

@@ -5,7 +5,7 @@ date: '2020-08-16'
 author: Rico Valdez, Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
 description: This search looks for cloud provisioning activities from previously unseen
   regions. Provisioning activities are defined broadly as any event that runs or creates
   something.

detections/cloud/detect_aws_console_login_by_new_user.yml

@@ -5,7 +5,7 @@ date: '2022-05-10'
 author: Rico Valdez, Splunk
 type: Hunting
 datamodel:
-- Authentication
+- Authentication.Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -5,7 +5,7 @@ date: '2020-10-07'
 author: Bhavin Patel, Splunk
 type: Hunting
 datamodel:
-- Authentication
+- Authentication.Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -5,7 +5,7 @@ date: '2020-10-07'
 author: Bhavin Patel, Splunk
 type: Hunting
 datamodel:
-- Authentication
+- Authentication.Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -5,7 +5,7 @@ date: '2020-10-07'
 author: Bhavin Patel, Splunk
 type: Hunting
 datamodel:
-- Authentication
+- Authentication.Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.

detections/endpoint/7zip_commandline_to_smb_share_path.yml

@@ -5,7 +5,7 @@ date: '2021-08-17'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search is to detect a suspicious 7z process with commandline pointing
   to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z
   to archive a sensitive files and place it in network share tmp folder. This search

detections/endpoint/batch_file_write_to_system32.yml

@@ -5,7 +5,8 @@ date: '2021-09-16'
 author: Michael Haag, Rico Valdez, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
 description: The search looks for a batch file (.bat) written to the Windows system
   directory tree.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes

detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml

@@ -5,7 +5,7 @@ date: '2021-09-06'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search is to detect a suspicious bcdedit commandline to configure
   the host from safe mode back to normal boot configuration. This technique was seen
   in blackMatter ransomware where it force the compromised host to boot in safe mode

detections/endpoint/bcdedit_failure_recovery_modification.yml

@@ -5,7 +5,7 @@ date: '2020-12-21'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search looks for flags passed to bcdedit.exe modifications to the
   built-in Windows error recovery boot configurations. This is typically used by ransomware
   to prevent recovery.

detections/endpoint/bits_job_persistence.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following query identifies Microsoft Background Intelligent Transfer
   Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
   The query identifies the parameters used to create, resume or add a file to a BITS

detections/endpoint/bitsadmin_download_file.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following query identifies Microsoft Background Intelligent Transfer
   Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
   object. In addition, look for `download` or `upload` on the command-line, the switches

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml

@@ -5,7 +5,7 @@ date: '2022-02-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: Certutil.exe may download a file from a remote destination using `-urlcache`.
   This behavior does require a URL to be passed on the command-line. In addition,
   `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will

detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml

@@ -5,7 +5,7 @@ date: '2022-02-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
   This behavior does require a URL to be passed on the command-line. In addition,
   `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will

detections/endpoint/certutil_exe_certificate_extraction.yml

@@ -5,14 +5,15 @@ date: '2022-07-15'
 author: Rod Soto, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search looks for arguments to certutil.exe indicating the manipulation
   or extraction of Certificate. This certificate can then be used to sign new authentication
   tokens specially inside Federated environments such as Windows ADFS.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="certutil.exe" Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name="certutil.exe"
+  Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `certutil_exe_certificate_extraction_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -21,8 +22,8 @@ known_false_positives: Unless there are specific use cases, manipulating or expo
   certificates using certutil is uncommon. Extraction of certificate has been observed
   during attacks such as Golden SAML and other campaigns targeting Federated services.
 references:
-  - https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack
-  - https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html
+- https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack
+- https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html
 tags:
   analytic_story:
   - Windows Persistence Techniques

detections/endpoint/certutil_with_decode_argument.yml

@@ -5,7 +5,7 @@ date: '2021-03-23'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
   and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
   and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded

detections/endpoint/change_default_file_association.yml

@@ -5,7 +5,7 @@ date: '2021-09-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Registry
 description: This analytic is developed to detect suspicious registry modification
   to change the default file association of windows to malicious payload. This techninique
   was seen in some APT where it modify the default process to run file association,
@@ -31,7 +31,7 @@ tags:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
   - Windows Registry Abuse
-  - Hermetic Wiper 
+  - Hermetic Wiper
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/change_to_safe_mode_with_network_config.yml

@@ -5,7 +5,7 @@ date: '2021-09-06'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search is to detect a suspicious bcdedit commandline to configure
   the host to boot in safe mode with network config. This technique was seen in blackMatter
   ransomware where it force the compromised host to boot in safe mode to continue

detections/endpoint/chcp_command_execution.yml

@@ -5,7 +5,7 @@ date: '2021-07-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search is to detect execution of chcp.exe application. this utility
   is used to change the active code page of the console. This technique was seen in
   icedid malware to know the locale region/language/country of the compromise host.

detections/endpoint/check_elevated_cmd_using_whoami.yml

@@ -5,7 +5,7 @@ date: '2021-09-15'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search is to detect a suspicious whoami execution to check if the
   cmd or shell instance process is with elevated privileges. This technique was seen
   in FIN7 js implant where it execute this as part of its data collection to the infected

detections/endpoint/clear_unallocated_sector_using_cipher_app.yml

@@ -5,7 +5,7 @@ date: '2021-06-10'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: this search is to detect execution of `cipher.exe` to clear the unallocated
   sectors of a specific disk. This technique was seen in some ransomware to make it
   impossible to forensically recover deleted files.

detections/endpoint/clop_common_exec_parameter.yml

@@ -5,7 +5,7 @@ date: '2021-03-17'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytics are designed to identifies some CLOP ransomware
   variant that using arguments to execute its main code or feature of its code. In
   this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files

detections/endpoint/clop_ransomware_known_service_name.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-03-17'
 author: Teoderick Contreras
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: This detection is to identify the common service name created by the
   CLOP ransomware as part of its persistence and high privilege code execution in
   the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -5,7 +5,7 @@ date: '2022-01-18'
 author: Teoderick Contreras, Bhavin Patel, Splunk
 type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies command-line arguments where `cmd.exe
   /c` is used to execute a program. `cmd /c` is used to run commands in MS-DOS and
   terminate after command or process completion. This technique is commonly seen in

detections/endpoint/cmd_echo_pipe___escalation.yml

@@ -5,7 +5,7 @@ date: '2021-05-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This analytic identifies a common behavior by Cobalt Strike and other
   frameworks where the adversary will escalate privileges, either via `jump` (Cobalt
   Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -5,7 +5,7 @@ date: '2021-09-14'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies a non-standard parent process (not
   matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`.
   This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also

detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-05-13'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: This analytic detects a potential process using COM Object like CMLUA
   or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries
   to gain administrative privileges to its running process.

detections/endpoint/common_ransomware_extensions.yml

@@ -5,7 +5,7 @@ date: '2020-11-09'
 author: David Dorsey, Splunk
 type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
 description: The search looks for file modifications with extensions commonly used
   by Ransomware
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)

detections/endpoint/common_ransomware_notes.yml

@@ -5,7 +5,7 @@ date: '2020-11-09'
 author: David Dorsey, Splunk
 type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
 description: The search looks for files created with names matching those typically
   used in ransomware notes that tell the victim how to get their data back.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)

detections/endpoint/conti_common_exec_parameter.yml

@@ -5,7 +5,7 @@ date: '2021-06-02'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search detects the suspicious commandline argument of revil ransomware
   to encrypt specific or all local drive and network shares of the compromised machine
   or host.

detections/endpoint/control_loading_from_world_writable_directory.yml

@@ -5,7 +5,7 @@ date: '2021-09-08'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following detection identifies control.exe loading either a .cpl
   or .inf from a writable directory. This is related to CVE-2021-40444. During triage,
   review parallel processes, parent and child, for further suspicious behaviors. In

detections/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -5,17 +5,18 @@ date: '2021-09-08'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search looks for the creation of local administrator accounts using
   net.exe .
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
   OR Processes.process_name="net1.exe") AND Processes.process="*/add*" AND (Processes.process="*administrators*"
-  OR Processes.process="*administratoren*" OR Processes.process="*administrateurs*" OR
-  Processes.process="*administrador*" OR Processes.process="*amministratori*" OR Processes.process="*administratorer*")
-  by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`'
+  OR Processes.process="*administratoren*" OR Processes.process="*administrateurs*"
+  OR Processes.process="*administrador*" OR Processes.process="*amministratori*" OR
+  Processes.process="*administratorer*") by Processes.process Processes.process_name
+  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.

detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml

@@ -5,7 +5,7 @@ date: '2020-09-16'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search looks for the creation or deletion of hidden shares using
   net.exe.
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as

detections/endpoint/create_remote_thread_in_shell_application.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-04'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: This search is to detect suspicious process injection in command shell.
   This technique was seen in IcedID where it execute cmd.exe process to inject its
   shellcode as part of its execution as banking trojan. It is really uncommon to have

detections/endpoint/creation_of_shadow_copy.yml

@@ -5,16 +5,16 @@ date: '2019-12-10'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: Monitor for signs that Vssadmin or Wmic has been used to create a shadow
   copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="vssadmin.exe"
   Processes.process="*create*" Processes.process="*shadow*") OR (Processes.process_name="wmic.exe"
-  Processes.process="*shadowcopy*" Processes.process="*create*") by Processes.dest Processes.user
-  Processes.process_name Processes.process  Processes.parent_process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`'
+  Processes.process="*shadowcopy*" Processes.process="*create*") by Processes.dest
+  Processes.user Processes.process_name Processes.process  Processes.parent_process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"

detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search detects the use of wmic and Powershell to create a shadow
   copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)

detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search detects credential dumping using copy command from a shadow
   copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)

detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search detects the creation of a symlink to a shadow copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*mklink*

detections/endpoint/csc_net_on_the_fly_compilation.yml

@@ -5,7 +5,7 @@ date: '2021-11-12'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: this analytic is to detect a suspicious compile before delivery approach
   of .net compiler csc.exe. This technique was seen in several adversaries, malware
   and even in red teams to take advantage the csc.exe .net compiler tool to compile

detections/endpoint/curl_download_and_bash_execution.yml

@@ -5,7 +5,7 @@ date: '2021-12-10'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies the use of curl on Linux or MacOS attempting
   to download a file from a remote source and pipe it to bash. This is typically found
   with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j.

detections/endpoint/delete_shadowcopy_with_powershell.yml

@@ -4,18 +4,16 @@ version: 2
 date: '2022-05-02'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: This following analytic detects PowerShell command to delete shadow copy
   using the WMIC PowerShell module. This technique was seen used by a recent adversary
   to deploy DarkSide Ransomware where it executed a child process of PowerShell to
   execute a hex encoded command to delete shadow copy. This hex encoded command was
   able to be decrypted by PowerShell log.
-search: '`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText = "*Delete*"
-  OR ScriptBlockText = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime
-  by Opcode Computer
-  UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `delete_shadowcopy_with_powershell_filter`'
+search: '`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText
+  = "*Delete*" OR ScriptBlockText = "*Remove*") | stats count min(_time) as firstTime
+  max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the powershell logs  from your endpoints. make sure you enable needed
   registry to monitor this event.

detections/endpoint/deleting_of_net_users.yml

@@ -5,7 +5,7 @@ date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some

detections/endpoint/deleting_shadow_copies.yml

@@ -5,7 +5,7 @@ date: '2020-11-09'
 author: David Dorsey, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy
   Service.  Wmic is an interface to the Windows Management Instrumentation.  This
   search looks for either of these tools being used to delete shadow copies.

detections/endpoint/detect_azurehound_command_line_arguments.yml

@@ -5,7 +5,7 @@ date: '2021-06-01'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies the common command-line argument used
   by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may
   be modified, but these changes are dependent upon the operator. In most instances

detections/endpoint/detect_azurehound_file_modifications.yml

@@ -5,7 +5,7 @@ date: '2021-06-01'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
 description: The following analytic is similar to SharpHound file modifications, but
   this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound
   equivilent but for Azure. It's possible this may never be seen in an environment

detections/endpoint/detect_exchange_web_shell.yml

@@ -5,7 +5,8 @@ date: '2021-10-05'
 author: Michael Haag, Shannon Davis, David Dorsey, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
 description: 'The following query identifies suspicious .aspx created in 3 paths identified
   by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM
   group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`,

detections/endpoint/detect_html_help_renamed.yml

@@ -5,7 +5,7 @@ date: '2022-04-07'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies a renamed instance of hh.exe (HTML
   Help) executing a Compiled HTML Help (CHM). This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any
@@ -18,10 +18,11 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM
   it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively
   found in C:\Windows\system32 and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name!="hh.exe" AND Processes.original_file_name="HH.EXE" by Processes.dest
-  Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name!="hh.exe"
+  AND Processes.original_file_name="HH.EXE" by Processes.dest Processes.user Processes.parent_process_name
+  Processes.original_file_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,

detections/endpoint/detect_html_help_spawn_child_process.yml

@@ -5,7 +5,7 @@ date: '2021-02-11'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
   HTML Help (CHM) that spawns a child process. This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any

detections/endpoint/detect_html_help_url_in_command_line.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
   HTML Help (CHM) file from a remote url. This particular technique will load Windows
   script code from a compiled help file. CHM files may  contain nearly any file type

detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
   HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
   will load Windows script code from a compiled help file, using InfoTech Storage

detections/endpoint/detect_mshta_inline_hta_execution.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Bhavin Patel, Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies "mshta.exe" execution with inline protocol
   handlers. "JavaScript", "VBScript", and "About" are the only supported options when
   invoking HTA content directly on the command-line. The search will return the first

detections/endpoint/detect_mshta_renamed.yml

@@ -5,18 +5,18 @@ date: '2022-04-07'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies renamed instances of mshta.exe executing.
   Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This
   analytic utilizes the internal name of the PE to identify if is the legitimate mshta
   binary. Further analysis should be performed to review the executed content and
   validation it is the real mshta.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name!="mshta.exe" AND Processes.original_file_name="MSHTA.EXE" by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id Processes.original_file_name |
-  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `detect_mshta_renamed_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name!="mshta.exe"
+  AND Processes.original_file_name="MSHTA.EXE" by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_mshta_renamed_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,

detections/endpoint/detect_mshta_url_in_command_line.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
   utility is used to make remote http connections. Adversaries may use mshta.exe to
   proxy the download and execution of remote .hta files. The analytic identifies command

detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml

@@ -5,7 +5,7 @@ date: '2020-07-03'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: 'The detection Detect Path Interception By Creation Of program exe is
   detecting the abuse of unquoted service paths, which is a popular technique for
   privilege escalation. '

detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml

@@ -5,7 +5,7 @@ date: '2020-11-10'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search looks for fast execution of processes used for system network
   configuration discovery on the endpoint.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)

detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml

@@ -5,7 +5,7 @@ date: '2020-11-10'
 author: Bhavin Patel, Splunk
 type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search looks for executions of cmd.exe spawned by a process that
   is often abused by attackers and that does not typically launch cmd.exe.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search looks for events where `PsExec.exe` is run with the `accepteula`
   flag in the command line. PsExec is a built-in Windows utility that enables you
   to execute processes on other systems. It is fully interactive for console applications.

detections/endpoint/detect_rclone_command_line_usage.yml

@@ -5,7 +5,7 @@ date: '2021-11-29'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This analytic identifies commonly used command-line arguments used by
   `rclone.exe` to initiate a file transfer. Some arguments were negated as they are
   specific to the configuration used by adversaries. In particular, an adversary may

detections/endpoint/detect_regasm_spawning_a_process.yml

@@ -5,7 +5,7 @@ date: '2021-02-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies regasm.exe spawning a process. This
   particular technique has been used in the wild to bypass application control products.
   Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process

detections/endpoint/detect_regasm_with_no_command_line_arguments.yml

@@ -5,7 +5,7 @@ date: '2022-03-15'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies regasm.exe with no command line arguments.
   This particular behavior occurs when another process injects into regasm.exe, no
   command line arguments will be present. During investigation, identify any network

detections/endpoint/detect_regsvcs_spawning_a_process.yml

@@ -5,7 +5,7 @@ date: '2021-02-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies regsvcs.exe spawning a process. This
   particular technique has been used in the wild to bypass application control products.
   Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process

detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml

@@ -5,7 +5,7 @@ date: '2022-03-15'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies regsvcs.exe with no command line arguments.
   This particular behavior occurs when another process injects into regsvcs.exe, no
   command line arguments will be present. During investigation, identify any network

detections/endpoint/detect_regsvr32_application_control_bypass.yml

@@ -5,7 +5,7 @@ date: '2021-01-28'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.
   Regsvr32.exe is a command-line program used to register and unregister object linking
   and embedding controls, including dynamic link libraries (DLLs), on Windows systems.

detections/endpoint/detect_renamed_7_zip.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies renamed 7-Zip usage using Sysmon. At
   this stage of an attack, review parallel processes and file modifications for data
   that is staged or potentially have been exfiltrated. This analytic utilizes the

detections/endpoint/detect_renamed_psexec.yml

@@ -5,17 +5,18 @@ date: '2022-04-07'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies renamed instances of `PsExec.exe` being
   utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe`
   or other SysInternal utility usage with the command-line argument of `-accepteula`.
   During triage, validate this is the legitimate version of `PsExec` by reviewing
   the PE metadata. In addition, review parallel processes for further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name!="psexec.exe" OR Processes.process_name!="psexec64.exe") AND Processes.original_file_name="psexec.c" by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id Processes.original_file_name |
-  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name!="psexec.exe"
+  OR Processes.process_name!="psexec64.exe") AND Processes.original_file_name="psexec.c"
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_psexec_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/detect_renamed_rclone.yml

@@ -4,8 +4,8 @@ version: 2
 date: '2021-09-16'
 author: Michael Haag, Splunk
 type: Hunting
-datamodel: 
-- Endpoint
+datamodel:
+- Endpoint.Processes
 description: The following analytic identifies the usage of `rclone.exe`, renamed,
   being used to exfiltrate data to a remote destination. RClone has been used by multiple
   ransomware groups to exfiltrate data. In many instances, it will be downloaded from

detections/endpoint/detect_renamed_winrar.yml

@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analtyic identifies renamed instances of `WinRAR.exe`.
   In most cases, it is not common for WinRAR to be used renamed, however it is common
   to be installed by a third party application and executed from a non-standard path.

detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

@@ -5,7 +5,7 @@ date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies rundll32.exe loading advpack.dll and
   ieadvpack.dll by calling the LaunchINFSection function on the command line. This
   particular technique will load script code from a file. Upon a successful execution,

detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml

@@ -5,7 +5,7 @@ date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies rundll32.exe loading setupapi.dll and
   iesetupapi.dll by calling the LaunchINFSection function on the command line. This
   particular technique will load script code from a file. Upon a successful execution,

detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml

@@ -5,7 +5,7 @@ date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies rundll32.exe loading syssetup.dll by
   calling the LaunchINFSection function on the command line. This particular technique
   will load script code from a file. Upon a successful execution, the following module

detections/endpoint/detect_rundll32_inline_hta_execution.yml

@@ -5,7 +5,7 @@ date: '2021-01-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies "rundll32.exe" execution with inline
   protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
   options when invoking HTA content directly on the command-line. This type of behavior

detections/endpoint/detect_sharphound_command_line_arguments.yml

@@ -5,7 +5,7 @@ date: '2021-06-01'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies common command-line arguments used
   by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS,
   function names may be modified, but these changes are dependent upon the operator.

detections/endpoint/detect_sharphound_file_modifications.yml

@@ -5,7 +5,7 @@ date: '2021-05-27'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
 description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound.
   SharpHound will query the domain controller and begin gathering all the data related
   to the domain and trusts. For output, it will drop a .zip file upon completion following

detections/endpoint/detect_sharphound_usage.yml

@@ -5,7 +5,7 @@ date: '2021-05-27'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: The following analytic identifies SharpHound binary usage by using the
   original filena,e. In addition to renaming the PE, other coverage is available to
   detect command-line arguments. This particular analytic looks for the original_file_name

detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml

@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Bhavin Patel, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search looks for the execution of the cscript.exe or wscript.exe
   processes, with a parent of cmd.exe. The search will return the count, the first
   and last time this execution was seen on a machine, the user, and the destination

detections/endpoint/disable_amsi_through_registry.yml

@@ -5,7 +5,8 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: this search is to identify modification in registry to disable AMSI windows
   feature to evade detections. This technique was seen in several ransomware, RAT
   and even APT to impaire defenses of the compromise machine and to be able to execute

detections/endpoint/disable_defender_antivirus_registry.yml

@@ -5,7 +5,8 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: This particular behavior is typically executed when an adversaries or
   malware gains access to an endpoint and beings to perform execution and to evade
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled

detections/endpoint/disable_defender_blockatfirstseen_feature.yml

@@ -5,7 +5,8 @@ date: '2022-01-26'
 author: Teoderick Contreras
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the BlockAtFirstSeen feature where it block

detections/endpoint/disable_defender_enhanced_notification.yml

@@ -5,7 +5,8 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the Enhanced Notification feature wher user

detections/endpoint/disable_defender_mpengine_registry.yml

@@ -5,7 +5,8 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: This particular behavior is typically executed when an adversaries or
   malware gains access to an endpoint and beings to perform execution and to evade
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled

detections/endpoint/disable_defender_spynet_reporting.yml

@@ -5,7 +5,8 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the spynet reporting for its telemetry.

detections/endpoint/disable_defender_submit_samples_consent_feature.yml

@@ -5,7 +5,8 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the submit samples feature for further analysis..

detections/endpoint/disable_etw_through_registry.yml

@@ -5,7 +5,8 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: this search is to identify modification in registry to disable ETW windows
   feature to evade detections. This technique was seen in several ransomware, RAT
   and even APT to impaire defenses of the compromise machine and to be able to execute

detections/endpoint/disable_logs_using_wevtutil.yml

@@ -5,7 +5,7 @@ date: '2021-06-10'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This search is to detect execution of wevtutil.exe to disable logs. This
   technique was seen in several ransomware to disable the event logs to evade alerts
   and detections.

detections/endpoint/disable_registry_tool.yml

@@ -5,7 +5,8 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: This search identifies modification of registry to disable the regedit
   or registry tools of the windows operating system. Since registry tool is a swiss
   knife in analyzing registry, malware such as RAT or trojan Spy disable this application

detections/endpoint/disable_schedule_task.yml

@@ -5,7 +5,7 @@ date: '2021-10-18'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
 description: This analytic is to detect a suspicious commandline to disable existing
   schedule task. This technique is used by adversaries or commodity malware like IceID
   to disable security application (AV products) in the targetted host to evade detections.
@@ -14,10 +14,10 @@ description: This analytic is to detect a suspicious commandline to disable exis
   is disabled. parent child process is quite valuable in this scenario too.
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="schtasks.exe"
-  Processes.process="*/change*"  Processes.process="*/disable*" by Processes.user Processes.process_name
-  Processes.process Processes.parent_process_name Processes.parent_process Processes.dest
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `disable_schedule_task_filter`'
+  Processes.process="*/change*"  Processes.process="*/disable*" by Processes.user
+  Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process
+  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `disable_schedule_task_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disable_security_logs_using_minint_registry.yml

@@ -5,7 +5,8 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: This analytic is to detect a suspicious registry modification to disable
   security audit logs. This technique was shared by a researcher to disable Security
   logs of windows by adding this registry. The Windows will think it is WinPE and

detections/endpoint/disable_show_hidden_files.yml

@@ -5,7 +5,8 @@ date: '2022-01-27'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: The following analytic is to identify a modification in the Windows registry
   to prevent users from seeing all the files with hidden attributes. This event or
   techniques are known on some worm and trojan spy malware that will drop hidden files

detections/endpoint/disable_uac_remote_restriction.yml

@@ -5,7 +5,8 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: This analytic is to detect a suspicious modification of registry to disable
   UAC remote restriction. This technique was well documented in Microsoft page where
   attacker may modify this registry value to bypassed UAC feature of windows host.

detections/endpoint/disable_windows_app_hotkeys.yml

@@ -5,7 +5,8 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: This analytic detects a suspicious registry modification to disable Windows
   hotkey (shortcut keys) for native Windows applications. This technique is commonly
   used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`.

detections/endpoint/disable_windows_behavior_monitoring.yml

@@ -5,7 +5,8 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: This search is to identifies a modification in registry to disable the
   windows denfender real time behavior monitoring. This event or technique is commonly
   seen in RAT, bot, or Trojan to disable AV to evade detections.

detections/endpoint/disable_windows_smartscreen_protection.yml

@@ -5,7 +5,8 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: The following search identifies a modification of registry to disable
   the smartscreen protection of windows machine. This is windows feature provide an
   early warning system against website that might engage in phishing attack or malware

detections/endpoint/disabling_cmd_application.yml

@@ -5,7 +5,8 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
 description: this search is to identify modification in registry to disable cmd prompt
   application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging
   or deleting there samples through cmd application which is one of the tool of analyst