From ddcb8942f3a8d23831a85690c6a955e0234384bd Mon Sep 17 00:00:00 2001
From: Gowthamaraj rajendran <gowthamarajr@splunk.com>
Date: Wed, 24 Jul 2024 09:17:46 -0700
Subject: [PATCH 01/23] Add critical alerts to risk index

---
 contentctl.yml                                |  6 +++
 .../critical_alerts_to_risk_index.yml         | 47 +++++++++++++++++++
 stories/critical_alerts.yml                   | 15 ++++++
 3 files changed, 68 insertions(+)
 create mode 100644 detections/endpoint/critical_alerts_to_risk_index.yml
 create mode 100644 stories/critical_alerts.yml

diff --git a/contentctl.yml b/contentctl.yml
index 93279c5acc..ecdbb7485a 100644
--- a/contentctl.yml
+++ b/contentctl.yml
@@ -176,6 +176,12 @@ apps:
   version: 5.4.1
   description: description of app
   hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_541.tgz
+- uid: 5518
+  title: Splunk add on for Microsoft Defender Advanced Hunting
+  appid: SPLUNK_ADD_ON_FOR_MICROSOFT_DEFENDER_ADVANCED_HUNTING
+  version: 1.3.7
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/microsoft-defender-advanced-hunting-add-on-for-splunk_137.tgz
 - uid: 2734
   title: URL Toolbox
   appid: URL_TOOLBOX
diff --git a/detections/endpoint/critical_alerts_to_risk_index.yml b/detections/endpoint/critical_alerts_to_risk_index.yml
new file mode 100644
index 0000000000..3d57e218df
--- /dev/null
+++ b/detections/endpoint/critical_alerts_to_risk_index.yml
@@ -0,0 +1,47 @@
+name: Critical Alerts To Risk Index
+id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd
+version: 1
+date: '2024-06-04'
+author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk
+status: production
+type: TTP
+data_source: []
+description: The primary objective of this rule is to integrate and assess critical alerts from Endpoint, DLP, and firewall sources within the splunk system. By correlating these alerts and incorporating MITRE annotations, the rule provides a comprehensive view of customer risk. It triggers an alert when critical alerts from these categories are detected, preserving the originating source and assigning risk scores. The rule helps security analysts better understand potential threats, enabling timely and effective responses to mitigate risks. The results are collected in the risk index for continuous monitoring and analysis.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.signature Alerts.app, Alerts.severity, Alerts.description, source, Alerts.id, Alerts.dest 
+  | `drop_dm_object_name("Alerts")`
+  | `critical_alerts_to_risk_index_filter`'
+how_to_implement: In order to properly run this search, Splunk needs to ingest data from other security products. 
+known_false_positives: False positives may vary by endpoint protection tool; monitor and adjust the risk scores as needed.
+references:
+  - https://attack.mitre.org/tactics/
+tags:
+  analytic_story:
+  - Critical Alerts
+  asset_type: Endpoint
+  atomic_guid: []
+  confidence: 90
+  impact: 90
+  message: $severity$ alert from $dest$ for $app$ with signature $signature$ and description $description$
+  mitre_attack_id:
+  - T1484
+  observable:
+  - name: dest
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - app
+  - name
+  risk_score: 81
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/AdvancedHunting.log
+    source: eventhub://windowsdefenderlogs
+    sourcetype: mscs:azure:eventhub:defender:advancedhunting
\ No newline at end of file
diff --git a/stories/critical_alerts.yml b/stories/critical_alerts.yml
new file mode 100644
index 0000000000..cc0ec67793
--- /dev/null
+++ b/stories/critical_alerts.yml
@@ -0,0 +1,15 @@
+name: Critical Alerts
+id: bc7056a5-c2b0-4b83-93ce-5f31739305c8
+date: '2024-06-21'
+author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk
+description: Rule for sending alerts to risk index.
+narrative: This story has rules that integrates and assesses critical alerts from Endpoint, DLP, and firewall sources in Splunk. By correlating alerts and adding MITRE annotations, it provides a comprehensive view of customer risk. It triggers an alert when critical alerts are detected, preserving the source and assigning risk scores. This helps security analysts understand threats and respond effectively.
+references:
+tags:
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
\ No newline at end of file

From 93e3af152cd69a3a43c383693c7accf5188e4cb4 Mon Sep 17 00:00:00 2001
From: Gowthamaraj rajendran <gowthamarajr@splunk.com>
Date: Mon, 5 Aug 2024 10:15:40 -0700
Subject: [PATCH 02/23] Edit the detection

---
 detections/endpoint/critical_alerts_to_risk_index.yml | 8 ++++----
 stories/critical_alerts.yml                           | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/critical_alerts_to_risk_index.yml b/detections/endpoint/critical_alerts_to_risk_index.yml
index 3d57e218df..4e5546aeb1 100644
--- a/detections/endpoint/critical_alerts_to_risk_index.yml
+++ b/detections/endpoint/critical_alerts_to_risk_index.yml
@@ -1,4 +1,4 @@
-name: Critical Alerts To Risk Index
+name: Detect Critical Alerts from Security Tools
 id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd
 version: 1
 date: '2024-06-04'
@@ -9,8 +9,8 @@ data_source: []
 description: The primary objective of this rule is to integrate and assess critical alerts from Endpoint, DLP, and firewall sources within the splunk system. By correlating these alerts and incorporating MITRE annotations, the rule provides a comprehensive view of customer risk. It triggers an alert when critical alerts from these categories are detected, preserving the originating source and assigning risk scores. The rule helps security analysts better understand potential threats, enabling timely and effective responses to mitigate risks. The results are collected in the risk index for continuous monitoring and analysis.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.signature Alerts.app, Alerts.severity, Alerts.description, source, Alerts.id, Alerts.dest 
   | `drop_dm_object_name("Alerts")`
-  | `critical_alerts_to_risk_index_filter`'
-how_to_implement: In order to properly run this search, Splunk needs to ingest data from other security products. 
+  | `detect_critical_alerts_from_security_tools_filter`'
+how_to_implement: In order to properly run this search, Splunk needs to ingest data from other security products such as crowdstrike, microsoft defender, or carbon black. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary. 
 known_false_positives: False positives may vary by endpoint protection tool; monitor and adjust the risk scores as needed.
 references:
   - https://attack.mitre.org/tactics/
@@ -28,7 +28,7 @@ tags:
   - name: dest
     type: Other
     role:
-    - Victim
+    - Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/stories/critical_alerts.yml b/stories/critical_alerts.yml
index cc0ec67793..abc59966c9 100644
--- a/stories/critical_alerts.yml
+++ b/stories/critical_alerts.yml
@@ -2,7 +2,7 @@ name: Critical Alerts
 id: bc7056a5-c2b0-4b83-93ce-5f31739305c8
 date: '2024-06-21'
 author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk
-description: Rule for sending alerts to risk index.
+description: The rules are designed to integrate and assess critical alerts from Endpoint, DLP, and firewall sources within Splunk. By correlating these alerts and enriching them with MITRE ATT&CK annotations, it offers a nuanced perspective on alerts risk profiles. This rule actively monitors for critical alerts, and upon detection, it triggers an alert that not only preserves the original source information but also assigns a quantified risk score.
 narrative: This story has rules that integrates and assesses critical alerts from Endpoint, DLP, and firewall sources in Splunk. By correlating alerts and adding MITRE annotations, it provides a comprehensive view of customer risk. It triggers an alert when critical alerts are detected, preserving the source and assigning risk scores. This helps security analysts understand threats and respond effectively.
 references:
 tags:

From b0d440aacc7f64149d227df77996e03e66bc4bc1 Mon Sep 17 00:00:00 2001
From: Gowthamaraj rajendran <gowthamarajr@splunk.com>
Date: Thu, 12 Sep 2024 11:22:59 -0700
Subject: [PATCH 03/23] edit detection

---
 ...index.yml => detect_critical_alerts_from_security_tools.yml} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename detections/endpoint/{critical_alerts_to_risk_index.yml => detect_critical_alerts_from_security_tools.yml} (99%)

diff --git a/detections/endpoint/critical_alerts_to_risk_index.yml b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
similarity index 99%
rename from detections/endpoint/critical_alerts_to_risk_index.yml
rename to detections/endpoint/detect_critical_alerts_from_security_tools.yml
index 4e5546aeb1..c90beaa60d 100644
--- a/detections/endpoint/critical_alerts_to_risk_index.yml
+++ b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
@@ -28,7 +28,7 @@ tags:
   - name: dest
     type: Other
     role:
-    - Endpoint
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

From 602d2c9c1e887b8dde22867f5925dc703144262d Mon Sep 17 00:00:00 2001
From: Gowthamaraj rajendran <gowthamarajr@splunk.com>
Date: Thu, 12 Sep 2024 17:23:00 -0700
Subject: [PATCH 04/23] edit SPL and dataset

---
 .../endpoint/detect_critical_alerts_from_security_tools.yml   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/detect_critical_alerts_from_security_tools.yml b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
index c90beaa60d..f3b1a84347 100644
--- a/detections/endpoint/detect_critical_alerts_from_security_tools.yml
+++ b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
@@ -5,10 +5,10 @@ date: '2024-06-04'
 author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk
 status: production
 type: TTP
-data_source: []
+data_source: ["windows defender logs"]
 description: The primary objective of this rule is to integrate and assess critical alerts from Endpoint, DLP, and firewall sources within the splunk system. By correlating these alerts and incorporating MITRE annotations, the rule provides a comprehensive view of customer risk. It triggers an alert when critical alerts from these categories are detected, preserving the originating source and assigning risk scores. The rule helps security analysts better understand potential threats, enabling timely and effective responses to mitigate risks. The results are collected in the risk index for continuous monitoring and analysis.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.signature Alerts.app, Alerts.severity, Alerts.description, source, Alerts.id, Alerts.dest 
-  | `drop_dm_object_name("Alerts")`
+  | `drop_dm_object_name("Alerts")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_critical_alerts_from_security_tools_filter`'
 how_to_implement: In order to properly run this search, Splunk needs to ingest data from other security products such as crowdstrike, microsoft defender, or carbon black. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary. 
 known_false_positives: False positives may vary by endpoint protection tool; monitor and adjust the risk scores as needed.

From 77aa23917945d3effac881359232e71dcd05d48c Mon Sep 17 00:00:00 2001
From: Gowthamaraj rajendran <gowthamarajr@splunk.com>
Date: Thu, 12 Sep 2024 18:26:48 -0700
Subject: [PATCH 05/23] Update TA to 1.4.1

---
 contentctl.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contentctl.yml b/contentctl.yml
index 1065261ec1..8e58f7eabf 100644
--- a/contentctl.yml
+++ b/contentctl.yml
@@ -181,7 +181,7 @@ apps:
   appid: SPLUNK_ADD_ON_FOR_MICROSOFT_DEFENDER_ADVANCED_HUNTING
   version: 1.3.7
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/microsoft-defender-advanced-hunting-add-on-for-splunk_137.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/microsoft-defender-advanced-hunting-add-on-for-splunk_141.tgz
 - uid: 2734
   title: URL Toolbox
   appid: URL_TOOLBOX

From 19f81c24ef99a2d1f520a645c16bcd129b12f45d Mon Sep 17 00:00:00 2001
From: Gowthamaraj rajendran <gowthamarajr@splunk.com>
Date: Tue, 24 Sep 2024 10:00:05 -0700
Subject: [PATCH 06/23] Add data source object

---
 data_sources/windows_defender_alerts.yml      | 67 +++++++++++++++++++
 ...ct_critical_alerts_from_security_tools.yml |  6 +-
 stories/critical_alerts.yml                   |  2 +
 3 files changed, 73 insertions(+), 2 deletions(-)
 create mode 100644 data_sources/windows_defender_alerts.yml

diff --git a/data_sources/windows_defender_alerts.yml b/data_sources/windows_defender_alerts.yml
new file mode 100644
index 0000000000..eae9475267
--- /dev/null
+++ b/data_sources/windows_defender_alerts.yml
@@ -0,0 +1,67 @@
+name: Windows Defender Alerts
+id: 91738e9e-d112-41c9-b91b-e5868d8993d7
+version: 1
+date: '2024-09-24'
+author: Gowthamaraj Rajendran
+description: Data source object for Windows Defender alerts
+source: eventhub://windowsdefenderlogs
+sourcetype: mscs:azure:eventhub:defender:advancedhunting
+separator: AlertId
+supported_TA:
+  - name: Splunk add on for Microsoft Defender Advanced Hunting
+    url: https://splunkbase.splunk.com/app/5518
+    version: 1.3.7
+fields:
+  - _time
+  - AlertId
+  - TenantId
+  - OperationName
+  - Category
+  - Timestamp
+  - EntityType
+  - EvidenceRole
+  - SHA1
+  - SHA256
+  - RemoteIP
+  - LocalIP
+  - RemoteUrl
+  - AccountName
+  - AccountDomain
+  - AccountSid
+  - AccountObjectId
+  - DeviceId
+  - ThreatFamily
+  - EvidenceDirection
+  - AdditionalFields
+  - MachineGroup
+  - NetworkMessageId
+  - ServiceSource
+  - FileName
+  - FolderPath
+  - ProcessCommandLine
+  - EmailSubject
+  - ApplicationId
+  - Application
+  - DeviceName
+  - FileSize
+  - RegistryKey
+  - RegistryValueName
+  - RegistryValueData
+  - AccountUpn
+  - OAuthApplicationId
+  - Categories
+  - Title
+  - AttackTechniques
+  - DetectionSource
+  - Severity
+example_log: {"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", "operationName": "Publish", 
+  "category": "AdvancedHunting-AlertEvidence", "properties": {"Timestamp": "2024-04-14T19:59:59.1549925Z", "AlertId": "dc25", 
+  "EntityType": "CloudResource", "EvidenceRole": "Impacted", "SHA1": null, "SHA256": null, "RemoteIP": null, "LocalIP": null, 
+  "RemoteUrl": null, "AccountName": null, "AccountDomain": null, "AccountSid": null, "AccountObjectId": null, "DeviceId": null, 
+  "ThreatFamily": null, "EvidenceDirection": null, "AdditionalFields": "{\"ResourceId\":\"/subscriptions/1-2-3-4/resourceGroups/pluginframework/
+  providers/Microsoft.Compute/virtualMachines/phantom-identity\",\"ResourceType\":\"Virtual Machine\",\"ResourceName\":\"phantom-identity\",\"Asset\":true,\"
+  Type\":\"azure-resource\",\"Role\":0,\"MergeByKey\":\"abcd=\",\"MergeByKeyHex\":\"1234\"}", "MachineGroup": null, "NetworkMessageId": null, "ServiceSource": 
+  "Microsoft Defender for Cloud", "FileName": null, "FolderPath": null, "ProcessCommandLine": null, "EmailSubject": null, "ApplicationId": null, "Application": 
+  null, "DeviceName": null, "FileSize": null, "RegistryKey": null, "RegistryValueName": null, "RegistryValueData": null, "AccountUpn": null, "OAuthApplicationId": 
+  null, "Categories": "[\"InitialAccess\"]", "Title": "Suspicious authentication activity", "AttackTechniques": "", "DetectionSource": "DefenderForServers", 
+  "Severity": "High"}, "Tenant": "DefaultTenant"}
diff --git a/detections/endpoint/detect_critical_alerts_from_security_tools.yml b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
index f3b1a84347..111f1ebe6d 100644
--- a/detections/endpoint/detect_critical_alerts_from_security_tools.yml
+++ b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
@@ -5,7 +5,7 @@ date: '2024-06-04'
 author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk
 status: production
 type: TTP
-data_source: ["windows defender logs"]
+data_source: ["windows defender alerts"]
 description: The primary objective of this rule is to integrate and assess critical alerts from Endpoint, DLP, and firewall sources within the splunk system. By correlating these alerts and incorporating MITRE annotations, the rule provides a comprehensive view of customer risk. It triggers an alert when critical alerts from these categories are detected, preserving the originating source and assigning risk scores. The rule helps security analysts better understand potential threats, enabling timely and effective responses to mitigate risks. The results are collected in the risk index for continuous monitoring and analysis.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.signature Alerts.app, Alerts.severity, Alerts.description, source, Alerts.id, Alerts.dest 
   | `drop_dm_object_name("Alerts")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -14,6 +14,8 @@ how_to_implement: In order to properly run this search, Splunk needs to ingest d
 known_false_positives: False positives may vary by endpoint protection tool; monitor and adjust the risk scores as needed.
 references:
   - https://attack.mitre.org/tactics/
+  - https://docs.splunk.com/Documentation/CIM/5.3.2/User/Alerts
+  - https://docs.splunk.com/Documentation/CIM/5.3.2/User/UsetheCAM
 tags:
   analytic_story:
   - Critical Alerts
@@ -26,7 +28,7 @@ tags:
   - T1484
   observable:
   - name: dest
-    type: Other
+    type: Endpoint
     role:
     - Victim
   product:
diff --git a/stories/critical_alerts.yml b/stories/critical_alerts.yml
index abc59966c9..b4abd69f4e 100644
--- a/stories/critical_alerts.yml
+++ b/stories/critical_alerts.yml
@@ -5,6 +5,8 @@ author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk
 description: The rules are designed to integrate and assess critical alerts from Endpoint, DLP, and firewall sources within Splunk. By correlating these alerts and enriching them with MITRE ATT&CK annotations, it offers a nuanced perspective on alerts risk profiles. This rule actively monitors for critical alerts, and upon detection, it triggers an alert that not only preserves the original source information but also assigns a quantified risk score.
 narrative: This story has rules that integrates and assesses critical alerts from Endpoint, DLP, and firewall sources in Splunk. By correlating alerts and adding MITRE annotations, it provides a comprehensive view of customer risk. It triggers an alert when critical alerts are detected, preserving the source and assigning risk scores. This helps security analysts understand threats and respond effectively.
 references:
+  - https://docs.splunk.com/Documentation/CIM/5.3.2/User/Alerts
+  - https://docs.splunk.com/Documentation/CIM/5.3.2/User/UsetheCAM
 tags:
   category:
   - Adversary Tactics

From 8451aead4f4179636498ba5eb6c79534bd000a4d Mon Sep 17 00:00:00 2001
From: Gowthamaraj rajendran <gowthamarajr@splunk.com>
Date: Tue, 24 Sep 2024 10:03:31 -0700
Subject: [PATCH 07/23] edit the data source example

---
 data_sources/windows_defender_alerts.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/data_sources/windows_defender_alerts.yml b/data_sources/windows_defender_alerts.yml
index eae9475267..f0a30d0c78 100644
--- a/data_sources/windows_defender_alerts.yml
+++ b/data_sources/windows_defender_alerts.yml
@@ -54,7 +54,7 @@ fields:
   - AttackTechniques
   - DetectionSource
   - Severity
-example_log: {"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", "operationName": "Publish", 
+example_log: '{"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", "operationName": "Publish", 
   "category": "AdvancedHunting-AlertEvidence", "properties": {"Timestamp": "2024-04-14T19:59:59.1549925Z", "AlertId": "dc25", 
   "EntityType": "CloudResource", "EvidenceRole": "Impacted", "SHA1": null, "SHA256": null, "RemoteIP": null, "LocalIP": null, 
   "RemoteUrl": null, "AccountName": null, "AccountDomain": null, "AccountSid": null, "AccountObjectId": null, "DeviceId": null, 
@@ -64,4 +64,4 @@ example_log: {"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-ab
   "Microsoft Defender for Cloud", "FileName": null, "FolderPath": null, "ProcessCommandLine": null, "EmailSubject": null, "ApplicationId": null, "Application": 
   null, "DeviceName": null, "FileSize": null, "RegistryKey": null, "RegistryValueName": null, "RegistryValueData": null, "AccountUpn": null, "OAuthApplicationId": 
   null, "Categories": "[\"InitialAccess\"]", "Title": "Suspicious authentication activity", "AttackTechniques": "", "DetectionSource": "DefenderForServers", 
-  "Severity": "High"}, "Tenant": "DefaultTenant"}
+  "Severity": "High"}, "Tenant": "DefaultTenant"}'

From d84019ce5a53a4c183557450e9f0aa0b1977fc87 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 30 Sep 2024 10:35:12 -0600
Subject: [PATCH 08/23] PSWA Updates

---
 ...ible_lateral_movement_powershell_spawn.yml |  1 +
 ...dentify_powershell_web_access_iis_pool.yml | 71 +++++++++++++++++++
 ...windows_iis_server_pswa_console_access.yml | 61 ++++++++++++++++
 stories/cisa_aa24_241a.yml                    |  3 +
 4 files changed, 136 insertions(+)
 create mode 100644 detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
 create mode 100644 detections/web/windows_iis_server_pswa_console_access.yml

diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
index ffa2ba48c5..f59d9d10de 100644
--- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
+++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
@@ -50,6 +50,7 @@ tags:
   - Hermetic Wiper
   - Data Destruction
   - Scheduled Tasks
+  - CISA AA24-241A
   asset_type: Endpoint
   confidence: 50
   impact: 90
diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
new file mode 100644
index 0000000000..dc39beb84b
--- /dev/null
+++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
@@ -0,0 +1,71 @@
+name: Windows Identify PowerShell Web Access IIS Pool
+id: d8419343-f0f8-4d8e-91cc-18bb531df87d
+version: 1
+date: '2024-09-09'
+author: Michael Haag, Splunk
+data_sources:
+- Windows Security 4648
+type: Hunting
+status: production
+description: This analytic detects and analyzes PowerShell Web Access (PSWA) usage in Windows environments. It tracks both connection attempts (EventID 4648) and successful logons (EventID 4624) associated with PSWA, providing a comprehensive view of access patterns. The analytic identifies PSWA's operational status, host servers, processes, and connection metrics. It highlights unique target accounts, domains accessed, and verifies logon types. This information is crucial for detecting potential misuse, such as lateral movement, brute force attempts, or unusual access patterns. By offering insights into PSWA activity, it enables security teams to quickly assess and investigate potential security incidents involving this powerful administrative tool.
+search: '`wineventlog_security` (EventCode=4648 OR EventCode=4624 OR EventCode=4625) SubjectUserName="pswa_pool"
+  | fields EventCode, SubjectUserName, TargetUserName, Computer, TargetDomainName, ProcessName, LogonType
+  | rename Computer as dest
+  | stats 
+      count(eval(EventCode=4648)) as "Connection Attempts",
+      count(eval(EventCode=4624)) as "Successful Logons",
+      count(eval(EventCode=4625)) as "Unsuccessful Logons",
+      dc(TargetUserName) as "Unique Target Accounts",
+      values(dest) as "PSWA Host",
+      dc(TargetDomainName) as "Unique Target Domains",
+      values(ProcessName) as "PSWA Process",
+      values(TargetUserName) as "Target Users List",
+      values(TargetServerName) as "Target Servers List",
+      values(LogonType) as "Logon Types"
+  | eval 
+      PSWA_Running = "Yes",
+      "PSWA Process" = mvindex(split(mvindex("PSWA Process", 0), "\\"), -1)
+  | fields PSWA_Running, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types"
+  | `security_content_ctime(firstTime)` 
+  |`security_content_ctime(lastTime)`
+  | `windows_identify_powershell_web_access_iis_pool_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event logs, specifically Event ID 4648 (A logon was attempted using explicit credentials). Ensure that your Windows systems are configured to audit logon events and that these logs are being forwarded to your SIEM or log management solution. You may need to enable advanced audit policy settings in Windows to capture these events. Additionally, make sure that your environment is set up to capture the necessary fields such as SubjectUserName, TargetUserName, Computer, TargetServerName, and ProcessName from these events. If you're using Splunk, ensure that you have the appropriate Windows TA installed and configured to collect these security logs.
+known_false_positives: False positives may occur if legitimate PSWA processes are used for administrative tasks. Careful review of the logs is recommended to distinguish between legitimate and malicious activity.
+references:
+- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
+- https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
+tags:
+  analytic_story:
+  - CISA AA24-241A
+  asset_type: Endpoint
+  confidence: 80
+  impact: 80
+  message: PowerShell Web Access (PSWA) activity detected on $dest$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - SubjectUserName
+  - TargetUserName
+  - dest
+  - TargetServerName
+  - ProcessName
+  risk_score: 64
+  security_domain: endpoint
+  cve: []
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/4648_pswa_pool.log
+    sourcetype: XmlWinEventLog
+    source: XmlWinEventLog:Security
diff --git a/detections/web/windows_iis_server_pswa_console_access.yml b/detections/web/windows_iis_server_pswa_console_access.yml
new file mode 100644
index 0000000000..ff8d524563
--- /dev/null
+++ b/detections/web/windows_iis_server_pswa_console_access.yml
@@ -0,0 +1,61 @@
+name: Windows IIS Server PSWA Console Access
+id: 914ab191-fa8a-48cb-83a6-0565e061f934
+version: 1
+date: '2024-09-30'
+author: Michael Haag, Splunk
+data_sources:
+- Windows IIS
+type: Hunting
+status: production
+description: This analytic detects access attempts to the PowerShell Web Access (PSWA) console on Windows IIS servers. It monitors web traffic for requests to PSWA-related URIs, which could indicate legitimate administrative activity or potential unauthorized access attempts. By tracking source IP, HTTP status, URI path, and HTTP method, it helps identify suspicious patterns or brute-force attacks targeting PSWA. This detection is crucial for maintaining the security of remote PowerShell management interfaces and preventing potential exploitation of this powerful administrative tool.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Web where Web.dest IN ("/pswa/*")
+    by Web.src Web.status Web.uri_path Web.dest Web.http_method 
+  Web.uri_query | `drop_dm_object_name("Web")`| `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_iis_server_pswa_console_access_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node.
+  In addition, confirm the latest CIM App 4.20 or higher is installed.
+known_false_positives: False positives may occur if legitimate PSWA processes are used for administrative tasks. Careful review of the logs is recommended to distinguish between legitimate and malicious activity.
+references:
+- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
+tags:
+  analytic_story:
+  - CISA AA24-241A
+  asset_type: Web Server
+  confidence: 80
+  impact: 40
+  message: Access to the PowerShell Web Access (PSWA) console detected from $src$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.src
+  - Web.status
+  - Web.uri_path
+  - Web.dest
+  - Web.http_method
+  - Web.uri_query
+  risk_score: 32
+  security_domain: network
+  cve: []
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/iis_pswaaccess.log
+    sourcetype: ms:iis:splunk
+    source: ms:iis:splunk
diff --git a/stories/cisa_aa24_241a.yml b/stories/cisa_aa24_241a.yml
index 63f341a44f..3e5732f6e4 100644
--- a/stories/cisa_aa24_241a.yml
+++ b/stories/cisa_aa24_241a.yml
@@ -8,6 +8,9 @@ narrative: As of August 2024, Iran-based cyber actors continue to exploit organi
 references:
   - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
   - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
+  - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/want-remote-powershell-management-from-your-browser-see-how-pswa/ba-p/255764
+  - https://learn.microsoft.com/en-us/powershell/module/powershellwebaccess/?view=winserver2012r2-ps
+  - https://arz101.medium.com/hackthebox-acute-ee0308b9b443
 tags:
   category:
   - Adversary Tactics

From 58f24d3680056aadaaaa1f3d50f7e168a67389c4 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 4 Oct 2024 09:35:04 -0600
Subject: [PATCH 09/23] try that

---
 .../windows_identify_powershell_web_access_iis_pool.yml       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
index dc39beb84b..645f8d79bc 100644
--- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
+++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
@@ -40,11 +40,11 @@ tags:
   asset_type: Endpoint
   confidence: 80
   impact: 80
-  message: PowerShell Web Access (PSWA) activity detected on $dest$.
+  message: PowerShell Web Access (PSWA) activity detected on $PSWA Host$.
   mitre_attack_id:
   - T1190
   observable:
-  - name: dest
+  - name: PSWA Host
     type: Hostname
     role:
     - Victim

From 2d336d3af696d6c081884b4a08d76307638db39f Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 4 Oct 2024 09:46:24 -0600
Subject: [PATCH 10/23] try again

---
 .../windows_identify_powershell_web_access_iis_pool.yml     | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
index 645f8d79bc..e669de0369 100644
--- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
+++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
@@ -25,7 +25,7 @@ search: '`wineventlog_security` (EventCode=4648 OR EventCode=4624 OR EventCode=4
   | eval 
       PSWA_Running = "Yes",
       "PSWA Process" = mvindex(split(mvindex("PSWA Process", 0), "\\"), -1)
-  | fields PSWA_Running, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types"
+  | fields PSWA_Running, dest, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types"
   | `security_content_ctime(firstTime)` 
   |`security_content_ctime(lastTime)`
   | `windows_identify_powershell_web_access_iis_pool_filter`'
@@ -40,11 +40,11 @@ tags:
   asset_type: Endpoint
   confidence: 80
   impact: 80
-  message: PowerShell Web Access (PSWA) activity detected on $PSWA Host$.
+  message: PowerShell Web Access (PSWA) IIS Application Pool activity detected on $dest$.
   mitre_attack_id:
   - T1190
   observable:
-  - name: PSWA Host
+  - name: dest
     type: Hostname
     role:
     - Victim

From e60c831b29e3403a2eb55947b152a3245f64065c Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 7 Oct 2024 12:04:10 -0600
Subject: [PATCH 11/23] Update
 windows_identify_powershell_web_access_iis_pool.yml

updated dataset
---
 .../windows_identify_powershell_web_access_iis_pool.yml         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
index e669de0369..65b5115b9b 100644
--- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
+++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
@@ -66,6 +66,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/4648_pswa_pool.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/4648_4624_pswa_pool.log
     sourcetype: XmlWinEventLog
     source: XmlWinEventLog:Security

From 55415915f05c3ab71b23e4d2bc7f9578a2b69d15 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 7 Oct 2024 12:50:32 -0600
Subject: [PATCH 12/23] updated today

---
 .../windows_identify_powershell_web_access_iis_pool.yml     | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
index 65b5115b9b..80d7e103ad 100644
--- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
+++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
@@ -25,7 +25,7 @@ search: '`wineventlog_security` (EventCode=4648 OR EventCode=4624 OR EventCode=4
   | eval 
       PSWA_Running = "Yes",
       "PSWA Process" = mvindex(split(mvindex("PSWA Process", 0), "\\"), -1)
-  | fields PSWA_Running, dest, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types"
+  | fields PSWA_Running, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types"
   | `security_content_ctime(firstTime)` 
   |`security_content_ctime(lastTime)`
   | `windows_identify_powershell_web_access_iis_pool_filter`'
@@ -40,11 +40,11 @@ tags:
   asset_type: Endpoint
   confidence: 80
   impact: 80
-  message: PowerShell Web Access (PSWA) IIS Application Pool activity detected on $dest$.
+  message: PowerShell Web Access (PSWA) IIS Application Pool activity detected on $PSWA Host$.
   mitre_attack_id:
   - T1190
   observable:
-  - name: dest
+  - name: PSWA Host
     type: Hostname
     role:
     - Victim

From 9544a896e757e3702cca99dc10bde5108e7508de Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Mon, 7 Oct 2024 14:30:37 -0700
Subject: [PATCH 13/23] data source

---
 .../windows_identify_powershell_web_access_iis_pool.yml         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
index 80d7e103ad..742ec1cc44 100644
--- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
+++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
@@ -4,7 +4,7 @@ version: 1
 date: '2024-09-09'
 author: Michael Haag, Splunk
 data_sources:
-- Windows Security 4648
+- Windows Event Log Security 4648
 type: Hunting
 status: production
 description: This analytic detects and analyzes PowerShell Web Access (PSWA) usage in Windows environments. It tracks both connection attempts (EventID 4648) and successful logons (EventID 4624) associated with PSWA, providing a comprehensive view of access patterns. The analytic identifies PSWA's operational status, host servers, processes, and connection metrics. It highlights unique target accounts, domains accessed, and verifies logon types. This information is crucial for detecting potential misuse, such as lateral movement, brute force attempts, or unusual access patterns. By offering insights into PSWA activity, it enables security teams to quickly assess and investigate potential security incidents involving this powerful administrative tool.

From a3534c0eaf6e10b8bb3c604fc8cc6e2500b782d7 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Mon, 7 Oct 2024 14:31:23 -0700
Subject: [PATCH 14/23] Update possible_lateral_movement_powershell_spawn.yml

---
 .../endpoint/possible_lateral_movement_powershell_spawn.yml   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
index f59d9d10de..cbe7e81e3b 100644
--- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
+++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
@@ -1,7 +1,7 @@
 name: Possible Lateral Movement PowerShell Spawn
 id: cb909b3e-512b-11ec-aa31-3e22fbd008af
-version: 5
-date: '2024-06-18'
+version: 6
+date: '2024-10-07'
 author: Mauricio Velazco, Michael Haag, Splunk
 status: production
 type: TTP

From 5b21374fc9d7e7199fb93591120c5eb7fa093e26 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Mon, 7 Oct 2024 14:31:49 -0700
Subject: [PATCH 15/23] Update cisa_aa24_241a.yml

---
 stories/cisa_aa24_241a.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stories/cisa_aa24_241a.yml b/stories/cisa_aa24_241a.yml
index 3e5732f6e4..1a7eba2bdf 100644
--- a/stories/cisa_aa24_241a.yml
+++ b/stories/cisa_aa24_241a.yml
@@ -1,7 +1,7 @@
 name: CISA AA24-241A
 id: f075adb6-76a6-4476-b24a-ce9d471a1bdc
-version: 1
-date: '2024-09-03'
+version: 2
+date: '2024-10-07'
 author: Michael Haag, Splunk
 description: This story covers the tactics of Iran-based cyber actors exploiting U.S. and foreign organizations across multiple sectors, as detailed in CISA Alert AA24-241A. It focuses on their methods of gaining initial access, establishing persistence, and enabling ransomware attacks through vulnerabilities in public-facing networking devices.
 narrative: As of August 2024, Iran-based cyber actors continue to exploit organizations across several U.S. sectors and other countries. The FBI assesses that a significant percentage of these operations aim to obtain network access for collaboration with ransomware affiliates. The actors typically use Shodan to identify vulnerable devices, then exploit public-facing networking equipment such as Citrix Netscaler, F5 BIG-IP, and various VPNs. They deploy webshells, create local accounts, and manipulate existing ones to maintain access. Post-exploitation, they repurpose credentials, disable security software, and use remote access tools. The group collaborates with ransomware affiliates like NoEscape, Ransomhouse, and ALPHV, actively participating in network lockdowns and extortion strategies. Defenders should prioritize patching public-facing devices, monitoring for unauthorized accounts and suspicious PowerShell activity, implementing strong access controls, and regularly reviewing logs for signs of compromise.
@@ -25,4 +25,4 @@ tags:
   - CVE-2019-19781
   - CVE-2023-3519
   - CVE-2022-1388
-  - CVE-2024-21887
\ No newline at end of file
+  - CVE-2024-21887

From 7644997fda542d133332831658e3448ae212ee15 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 9 Oct 2024 10:15:20 +0200
Subject: [PATCH 16/23] fix_change_file_owner_to_root

---
 .../endpoint/linux_auditd_change_file_owner_to_root.yml     | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml
index 23917623b0..82409f418b 100644
--- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml
+++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml
@@ -1,7 +1,7 @@
 name: Linux Auditd Change File Owner To Root
 id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90
-version: 1
-date: '2024-09-04'
+version: 2
+date: '2024-10-09'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects the use of the 'chown' command to ch
 data_source:
 - Linux Auditd Proctitle
 search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as
-  dest | where LIKE (process_exec, "%chown %") AND LIKE (process_exec, "% root %")
+  dest | where LIKE (process_exec, "%chown %root%")
   | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle
   normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `linux_auditd_change_file_owner_to_root_filter`'

From ee35624da02a1766d54d79dd15d822d5ab2850ce Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Wed, 9 Oct 2024 16:05:40 -0700
Subject: [PATCH 17/23] updating

---
 ...detect_critical_alerts_from_security_tools.yml | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/detect_critical_alerts_from_security_tools.yml b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
index 111f1ebe6d..232aa34073 100644
--- a/detections/endpoint/detect_critical_alerts_from_security_tools.yml
+++ b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
@@ -1,17 +1,18 @@
 name: Detect Critical Alerts from Security Tools
 id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd
 version: 1
-date: '2024-06-04'
-author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk
+date: '2024-10-09'
+author: Gowthamaraj Rajendran, Patrick Bareiss, Bhavin Patel, Splunk
 status: production
 type: TTP
-data_source: ["windows defender alerts"]
-description: The primary objective of this rule is to integrate and assess critical alerts from Endpoint, DLP, and firewall sources within the splunk system. By correlating these alerts and incorporating MITRE annotations, the rule provides a comprehensive view of customer risk. It triggers an alert when critical alerts from these categories are detected, preserving the originating source and assigning risk scores. The rule helps security analysts better understand potential threats, enabling timely and effective responses to mitigate risks. The results are collected in the risk index for continuous monitoring and analysis.
+data_source:
+- Windows Defender Alerts
+description: The following analytics is to detect high and critical alerts from endpoint security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query aggregates and summarizes critical severity alerts from the Alerts data model, providing details such as the alert signature, application, description, source, destination, and timestamps, while applying custom filters and formatting for enhanced analysis in a SIEM environment.This capability allows security teams to efficiently allocate resources and maintain a strong security posture, while also supporting compliance with regulatory requirements by providing a clear record of critical security events. We tested these detections with logs from Microsoft Defender, however this detection should work for any security alerts that are ingested into the alerts data model.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.signature Alerts.app, Alerts.severity, Alerts.description, source, Alerts.id, Alerts.dest 
   | `drop_dm_object_name("Alerts")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_critical_alerts_from_security_tools_filter`'
-how_to_implement: In order to properly run this search, Splunk needs to ingest data from other security products such as crowdstrike, microsoft defender, or carbon black. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary. 
-known_false_positives: False positives may vary by endpoint protection tool; monitor and adjust the risk scores as needed.
+how_to_implement: In order to properly run this search, you to ingest alerts data from other security products such as Crowdstrike, Microsoft Defender, or Carbon Black using appropriate TAs for that technology. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary. 
+known_false_positives: False positives may vary by endpoint protection tool; monitor and filter out the alerts that are not relevant to your environment.
 references:
   - https://attack.mitre.org/tactics/
   - https://docs.splunk.com/Documentation/CIM/5.3.2/User/Alerts
@@ -23,7 +24,7 @@ tags:
   atomic_guid: []
   confidence: 90
   impact: 90
-  message: $severity$ alert from $dest$ for $app$ with signature $signature$ and description $description$
+  message: $severity$ alert from dest - [$dest$] for $app$ with signature [$signature$] from vendor source - [$source$]
   mitre_attack_id:
   - T1484
   observable:

From ad27516532bad3025db54b2ec513f77b575345d5 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Wed, 9 Oct 2024 16:05:43 -0700
Subject: [PATCH 18/23] updating

---
 ...ect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml | 5 +++--
 .../detect_spike_in_aws_security_hub_alerts_for_user.yml     | 5 +++--
 .../endpoint/detect_critical_alerts_from_security_tools.yml  | 4 ++--
 stories/critical_alerts.yml                                  | 4 ++--
 4 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
index 131d791a79..bc038dda3a 100644
--- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
+++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
@@ -1,7 +1,7 @@
 name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
 id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
-version: 4
-date: '2024-05-19'
+version: 5
+date: '2024-10-09'
 author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
@@ -31,6 +31,7 @@ references: []
 tags:
   analytic_story:
   - AWS Security Hub Alerts
+  - Critical Alerts
   asset_type: AWS Instance
   confidence: 50
   impact: 30
diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
index 14a717bb9a..9bcb340cbe 100644
--- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
+++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
@@ -1,7 +1,7 @@
 name: Detect Spike in AWS Security Hub Alerts for User
 id: 2a9b80d3-6220-4345-b5ad-290bf5d0d222
-version: 4
-date: '2024-05-18'
+version: 5
+date: '2024-10-09'
 author: Bhavin Patel, Splunk
 status: experimental
 type: Anomaly
@@ -28,6 +28,7 @@ references: []
 tags:
   analytic_story:
   - AWS Security Hub Alerts
+  - Critical Alerts
   asset_type: AWS Instance
   confidence: 50
   impact: 50
diff --git a/detections/endpoint/detect_critical_alerts_from_security_tools.yml b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
index 232aa34073..ea402f751c 100644
--- a/detections/endpoint/detect_critical_alerts_from_security_tools.yml
+++ b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
@@ -14,9 +14,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 how_to_implement: In order to properly run this search, you to ingest alerts data from other security products such as Crowdstrike, Microsoft Defender, or Carbon Black using appropriate TAs for that technology. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary. 
 known_false_positives: False positives may vary by endpoint protection tool; monitor and filter out the alerts that are not relevant to your environment.
 references:
-  - https://attack.mitre.org/tactics/
+  - https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/accessing-microsoft-defender-for-cloud-alerts-in-splunk-using/ba-p/938228
   - https://docs.splunk.com/Documentation/CIM/5.3.2/User/Alerts
-  - https://docs.splunk.com/Documentation/CIM/5.3.2/User/UsetheCAM
+  - https://learn.microsoft.com/en-us/defender-endpoint/api/raw-data-export-event-hub
 tags:
   analytic_story:
   - Critical Alerts
diff --git a/stories/critical_alerts.yml b/stories/critical_alerts.yml
index b4abd69f4e..4ca55286b5 100644
--- a/stories/critical_alerts.yml
+++ b/stories/critical_alerts.yml
@@ -2,8 +2,8 @@ name: Critical Alerts
 id: bc7056a5-c2b0-4b83-93ce-5f31739305c8
 date: '2024-06-21'
 author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk
-description: The rules are designed to integrate and assess critical alerts from Endpoint, DLP, and firewall sources within Splunk. By correlating these alerts and enriching them with MITRE ATT&CK annotations, it offers a nuanced perspective on alerts risk profiles. This rule actively monitors for critical alerts, and upon detection, it triggers an alert that not only preserves the original source information but also assigns a quantified risk score.
-narrative: This story has rules that integrates and assesses critical alerts from Endpoint, DLP, and firewall sources in Splunk. By correlating alerts and adding MITRE annotations, it provides a comprehensive view of customer risk. It triggers an alert when critical alerts are detected, preserving the source and assigning risk scores. This helps security analysts understand threats and respond effectively.
+description: This analytic story contains detections that monitor critical alerts data from security tools ingested into Splunk. By correlating these alerts and enriching them with MITRE ATT&CK annotations and other risk events, it offers a nuanced perspective on potential threats and security posture of your organization.
+narrative: Monitoring alerts from security tools is crucial because they act as an early warning system for potential threats. High and critical alerts signal serious issues that could compromise your systems if not addressed promptly. By keeping an eye on these alerts, you can quickly identify and respond to threats, minimizing damage and protecting sensitive data. This proactive approach not only strengthens your security posture but also ensures you're ready to tackle any compliance requirements by maintaining a detailed record of significant security events. This story has rules that integrates and assesses critical alerts from Endpoint, DLP, and firewall sources in Splunk. By correlating alerts and adding MITRE annotations, it provides a comprehensive view of customer risk. It triggers an alert when critical alerts are detected, preserving the source and assigning risk scores. This helps security analysts understand threats and respond effectively.
 references:
   - https://docs.splunk.com/Documentation/CIM/5.3.2/User/Alerts
   - https://docs.splunk.com/Documentation/CIM/5.3.2/User/UsetheCAM

From 4702243b86a3e63dcbaea1ee253c5d237c9894d9 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Wed, 9 Oct 2024 17:06:22 -0700
Subject: [PATCH 19/23] updating detection

---
 detections/endpoint/windows_adfind_exe.yml | 42 +++++++++++++---------
 1 file changed, 25 insertions(+), 17 deletions(-)

diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml
index 2b826ac1f4..b92855ac49 100644
--- a/detections/endpoint/windows_adfind_exe.yml
+++ b/detections/endpoint/windows_adfind_exe.yml
@@ -1,28 +1,32 @@
 name: Windows AdFind Exe
 id: bd3b0187-189b-46c0-be45-f52da2bae67f
-version: 4
-date: '2024-05-13'
+version: 5
+date: '2024-10-09'
 author: Jose Hernandez, Bhavin Patel, Splunk
 status: production
 type: TTP
-description: 'The following analytic identifies the execution of `adfind.exe` with
-  specific command-line arguments related to Active Directory queries. It leverages
-  data from Endpoint Detection and Response (EDR) agents, focusing on process names,
-  command-line arguments, and parent processes. This activity is significant because
-  `adfind.exe` is a powerful tool often used by threat actors like Wizard Spider and
-  FIN6 to gather sensitive AD information. If confirmed malicious, this activity could
-  allow attackers to map the AD environment, facilitating further attacks such as
-  privilege escalation or lateral movement.'
+description: 'The following analytic identifies the execution of
+  specific command-line arguments that are associated with AdFind.exe, a command-line
+  tool for AD administration and management. AdFind can be misused by malicious actors to gather sensitive information from Active Directory, such as user accounts, group memberships, and network configurations. This information can be leveraged to identify high-value targets, escalate privileges, or plan further attacks within an organization's network. Unauthorized use of AdFind can lead to data breaches and compromise the security of the entire Active Directory environment. It leverages data from Endpoint Detection
+  and Response (EDR) agents, focusing on process names, command-line arguments, and
+  parent processes. This activity is significant because `adfind.exe` is a powerful
+  tool often used by threat actors like Wizard Spider and FIN6 to gather sensitive AD
+  information. If confirmed malicious, this activity could allow attackers to map the
+  AD environment, facilitating further attacks such as privilege escalation or lateral
+  movement.'
 data_source:
 - Sysmon EventID 1
 - Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process="* -f *"
-  OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="*
-  -gcb *" OR Processes.process="* -sc *") by Processes.dest Processes.user Processes.process_name
-  Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+    as lastTime from datamodel=Endpoint.Processes where ((Processes.process="* -f *"
+    OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="*
+  -gcb *" OR Processes.process="* -sc *" )) OR ((Processes.process="*trustdmp*" OR Processes.process="*dclist*")) by Processes.dest Processes.user Processes.process_name
+    Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_adfind_exe_filter`
   | `windows_adfind_exe_filter`'
 how_to_implement: The detection is based on data that originates from Endpoint Detection
   and Response (EDR) agents. These agents are designed to provide security-related
@@ -51,7 +55,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: Windows AdFind Exe
+  message: Windows AdFind Exe detected with command-line arguments associated with Active Directory queries on machine - [dest]
   mitre_attack_id:
   - T1018
   observable:
@@ -59,6 +63,10 @@ tags:
     type: User
     role:
     - Victim
+   - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -80,4 +88,4 @@ tests:
   - data: 
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
+    sourcetype: xmlwineventlog
\ No newline at end of file

From e95c2d274fbf0b24cdee70cf270559a4e3350149 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Wed, 9 Oct 2024 17:33:20 -0700
Subject: [PATCH 20/23] updating detection

---
 detections/endpoint/windows_adfind_exe.yml | 39 +++++++++-------------
 1 file changed, 16 insertions(+), 23 deletions(-)

diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml
index b92855ac49..73869ab1f4 100644
--- a/detections/endpoint/windows_adfind_exe.yml
+++ b/detections/endpoint/windows_adfind_exe.yml
@@ -5,29 +5,19 @@ date: '2024-10-09'
 author: Jose Hernandez, Bhavin Patel, Splunk
 status: production
 type: TTP
-description: 'The following analytic identifies the execution of
-  specific command-line arguments that are associated with AdFind.exe, a command-line
-  tool for AD administration and management. AdFind can be misused by malicious actors to gather sensitive information from Active Directory, such as user accounts, group memberships, and network configurations. This information can be leveraged to identify high-value targets, escalate privileges, or plan further attacks within an organization's network. Unauthorized use of AdFind can lead to data breaches and compromise the security of the entire Active Directory environment. It leverages data from Endpoint Detection
-  and Response (EDR) agents, focusing on process names, command-line arguments, and
-  parent processes. This activity is significant because `adfind.exe` is a powerful
-  tool often used by threat actors like Wizard Spider and FIN6 to gather sensitive AD
-  information. If confirmed malicious, this activity could allow attackers to map the
-  AD environment, facilitating further attacks such as privilege escalation or lateral
-  movement.'
+description: 'The following analytic identifies the execution of `adfind.exe` with
+  specific command-line arguments related to Active Directory queries. It leverages
+  data from Endpoint Detection and Response (EDR) agents, focusing on process names,
+  command-line arguments, and parent processes. This activity is significant because
+  `adfind.exe` is a powerful tool often used by threat actors like Wizard Spider and
+  FIN6 to gather sensitive AD information. If confirmed malicious, this activity could
+  allow attackers to map the AD environment, facilitating further attacks such as
+  privilege escalation or lateral movement.'
 data_source:
 - Sysmon EventID 1
 - Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where ((Processes.process="* -f *"
-    OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="*
-  -gcb *" OR Processes.process="* -sc *" )) OR ((Processes.process="*trustdmp*" OR Processes.process="*dclist*")) by Processes.dest Processes.user Processes.process_name
-    Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id 
-| `drop_dm_object_name(Processes)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
-| `windows_adfind_exe_filter`
-  | `windows_adfind_exe_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="*-gcb *" OR Processes.process="* -sc *" )) OR ((Processes.process="*trustdmp*" OR Processes.process="*dclist*")) by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter`| `windows_adfind_exe_filter`'
 how_to_implement: The detection is based on data that originates from Endpoint Detection
   and Response (EDR) agents. These agents are designed to provide security-related
   telemetry from the endpoints where the agent is installed. To implement this search,
@@ -56,6 +46,13 @@ tags:
   confidence: 50
   impact: 50
   message: Windows AdFind Exe detected with command-line arguments associated with Active Directory queries on machine - [dest]
+  atomic_guid:
+  - 736b4f53-f400-4c22-855d-1a6b5a551600
+  - b95fd967-4e62-4109-b48d-265edfd28c3a
+  - e1ec8d20-509a-4b9a-b820-06c9b2da8eb7
+  - 5e2938fb-f919-47b6-8b29-2f6a1f718e99
+  - abf00f6c-9983-4d9a-afbc-6b1c6c6448e1
+  - 51a98f96-0269-4e09-a10f-e307779a8b05
   mitre_attack_id:
   - T1018
   observable:
@@ -63,10 +60,6 @@ tags:
     type: User
     role:
     - Victim
-   - name: dest
-    type: Endpoint
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

From 98d0b4ed188f26333b0219986f008b1db675a7eb Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Tue, 15 Oct 2024 13:05:22 -0700
Subject: [PATCH 21/23] version bump

---
 contentctl.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contentctl.yml b/contentctl.yml
index 92ab87dc3e..b51cd9b93e 100644
--- a/contentctl.yml
+++ b/contentctl.yml
@@ -3,7 +3,7 @@ app:
   uid: 3449
   title: ES Content Updates
   appid: DA-ESS-ContentUpdate
-  version: 4.39.1
+  version: 4.42.0
   description: Explore the Analytic Stories included with ES Content Updates.
   prefix: ESCU
   label: ESCU

From f0dfaebf3915826711aca6ef558c923375904d6e Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Tue, 15 Oct 2024 13:44:46 -0700
Subject: [PATCH 22/23] updates per Lous feedback

---
 contentctl.yml                                                  | 2 +-
 data_sources/windows_defender_alerts.yml                        | 2 +-
 .../endpoint/detect_critical_alerts_from_security_tools.yml     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/contentctl.yml b/contentctl.yml
index 3260573651..43c4ee9306 100644
--- a/contentctl.yml
+++ b/contentctl.yml
@@ -179,7 +179,7 @@ apps:
 - uid: 5518
   title: Splunk add on for Microsoft Defender Advanced Hunting
   appid: SPLUNK_ADD_ON_FOR_MICROSOFT_DEFENDER_ADVANCED_HUNTING
-  version: 1.3.7
+  version: 1.4.1
   description: description of app
   hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/microsoft-defender-advanced-hunting-add-on-for-splunk_141.tgz
 - uid: 2734
diff --git a/data_sources/windows_defender_alerts.yml b/data_sources/windows_defender_alerts.yml
index f0a30d0c78..83a470bf4b 100644
--- a/data_sources/windows_defender_alerts.yml
+++ b/data_sources/windows_defender_alerts.yml
@@ -10,7 +10,7 @@ separator: AlertId
 supported_TA:
   - name: Splunk add on for Microsoft Defender Advanced Hunting
     url: https://splunkbase.splunk.com/app/5518
-    version: 1.3.7
+    version: 1.4.1
 fields:
   - _time
   - AlertId
diff --git a/detections/endpoint/detect_critical_alerts_from_security_tools.yml b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
index ea402f751c..be849e941a 100644
--- a/detections/endpoint/detect_critical_alerts_from_security_tools.yml
+++ b/detections/endpoint/detect_critical_alerts_from_security_tools.yml
@@ -24,7 +24,7 @@ tags:
   atomic_guid: []
   confidence: 90
   impact: 90
-  message: $severity$ alert from dest - [$dest$] for $app$ with signature [$signature$] from vendor source - [$source$]
+  message: $severity$ alert for $dest$ from $source$ - $signature$
   mitre_attack_id:
   - T1484
   observable:

From 08460e10ea8b36dc3728fefc60b4d9492b52e83f Mon Sep 17 00:00:00 2001
From: pyth0n1c <emcginnis@splunk.com>
Date: Tue, 15 Oct 2024 18:50:32 -0400
Subject: [PATCH 23/23] fix misisng version for one analytic story

---
 stories/critical_alerts.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/stories/critical_alerts.yml b/stories/critical_alerts.yml
index 4ca55286b5..cbb7bc2d47 100644
--- a/stories/critical_alerts.yml
+++ b/stories/critical_alerts.yml
@@ -1,5 +1,6 @@
 name: Critical Alerts
 id: bc7056a5-c2b0-4b83-93ce-5f31739305c8
+version: 1
 date: '2024-06-21'
 author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk
 description: This analytic story contains detections that monitor critical alerts data from security tools ingested into Splunk. By correlating these alerts and enriching them with MITRE ATT&CK annotations and other risk events, it offers a nuanced perspective on potential threats and security posture of your organization.