Merge branch 'develop' into ssa_why_chrome_why

2026-06-08 17:32:49 +00:00 · 2021-11-10 17:25:46 -06:00
parent 33f77142de d1d7ba39d6
commit 554609566e
41 changed files with 935 additions and 116 deletions
@@ -15,13 +15,16 @@ description: This search is to detect a suspicious MS office application that dr
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
  where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
-  | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
-  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
  where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1")
  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
-  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
-  file_name file_path process_name process_path process] | dedup file_create_time
-  | table dest, process_name, process, file_create_time, file_name, file_path | `office_application_drop_executable_filter`'
+  Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)`
+  | rename process_guid as proc_guid | fields _time dest file_create_time file_name
+  file_path process_name process_path process proc_guid] | dedup file_create_time
+  | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid
+  | `office_application_drop_executable_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -10,12 +10,12 @@ description: this detection was designed to identifies suspicious spawned proces
  of known MS office application due to macro or malicious code. this technique can
  be seen in so many malware like trickbot that used MS office as its weapon or attack
  vector to initially infect the machines.
-search: '| tstats `security_content_summariesonly` count values(Processes.process)
-  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name
-  = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") `process_rundll32`  by
-  Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid
-  Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") AND `process_rundll32` 
+  by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest 
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)`
  | `office_application_spawn_rundll32_process_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
@@ -1,4 +1,4 @@
-name: Regsvr32 Silent Param Dll Loading
+name: Regsvr32 Silent and Install Param Dll Loading
 id: f421c250-24e7-11ec-bc43-acde48001122
 version: 1
 date: '2021-10-04'
@@ -8,20 +8,21 @@ datamodel:
 - Endpoint
 description: This analytic is to detect a loading of dll using regsvr32 application
  with silent parameter and dllinstall execution. This technique was seen in several
-  RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised
-  machine. This TTP may executed by normal 3rd party application so it is better to
-  pivot the parent process, parent commandline and commandline of the file that execute
-  this regsvr32.
+  RAT malware similar to remcos, njrat and adversaries to load their malicious DLL
+  on the compromised machine. This TTP may executed by normal 3rd party application
+  so it is better to pivot by the parent process, parent command-line and command-line
+  of the file that execute this regsvr32.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe
-  Processes.process="*/i*" Processes.process="*/s*" by Processes.dest Processes.parent_process
-  Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `regsvr32_silent_param_dll_loading_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` AND Processes.process="*/i*"
+  by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where
+  match(process,"(?i)[\-|\/]s(il*e*n*t*)*") | `regsvr32_silent_and_install_param_dll_loading_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Other third part application may used this parameter but not
  so common in base windows environment.
 references:
@@ -40,7 +41,9 @@ tags:
  impact: 60
  kill_chain_phases:
  - Exploitation
-  message: regsvr32 process with $process$ commandline in $dest$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to load a DLL using the silent and
+    dllinstall parameter.
  mitre_attack_id:
  - T1218
  - T1218.010
@@ -53,6 +56,14 @@ tags:
    type: Hostname
    role:
    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -1,4 +1,4 @@
-name: Suspicious IcedID Regsvr32 Cmdline
+name: Regsvr32 with Known Silent Switch Cmdline
 id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122
 version: 2
 date: '2021-07-27'
@@ -6,16 +6,20 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: this search is to detect a suspicious regsvr32 commandline "-s" to execute
-  a dll files. This technique was seen in IcedID malware to execute its initial downloader
-  dll that will download the 2nd stage loader that will download and decrypt the config
-  payload.
+description: The following analytic identifies Regsvr32.exe utilizing the silent switch
+  to load DLLs. This technique has most recently been seen in IcedID campaigns to
+  load its initial dll that will download the 2nd stage loader that will download
+  and decrypt the config payload. The switch type may be either a hyphen `-` or forward
+  slash `/`. This behavior is typically found with `-s`, and it is possible there
+  are more switch types that may be used. \ During triage, review parallel processes
+  and capture any artifacts that may have landed on disk. Isolate and contain the
+  endpoint as necessary.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process=*-s*
-  by  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name
-  Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
-  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_icedid_regsvr32_cmdline_filter`'
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` by Processes.user
+  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name
+  Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/]s(il*e*n*t*)*")
+  | `regsvr32_with_known_silent_switch_cmdline_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -25,9 +29,11 @@ known_false_positives: minimal. but network operator can use this application to
  dll.
 references:
 - https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/
+- https://regexr.com/699e2
 tags:
  analytic_story:
  - IcedID
+  - Suspicious Regsvr32 Activity
  automated_detection_testing: passed
  confidence: 80
  context:
@@ -38,19 +44,28 @@ tags:
  impact: 70
  kill_chain_phases:
  - Exploitation
-  message: regsvr32 process $process_name$ with commandline $process$ in host $dest$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to load a DLL using the silent parameter.
  mitre_attack_id:
  - T1218
  - T1218.010
  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
-  - name: process_name
-    type: process name
+  - name: parent_process_name
+    type: Parent Process
    role:
-    - Attacker
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -1,15 +1,12 @@
 name: Detect Prohibited Applications Spawning cmd exe
 id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
 version: 2
-date: 2020-11-10
+date: '2020-11-10'
 author: Ignacio Bermudez Corrales, Splunk
-type: TTP
 datamodel:
    - Endpoint_Processes
-description: This search looks for executions of cmd.exe spawned by a process that
-  is often abused by attackers and that does not typically launch cmd.exe. This is
-  a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe`
-  by @bpatel.
+type: Anomaly
+description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further.'
 search: '| from read_ssa_enriched_events()
  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
  | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -27,32 +24,25 @@ search: '| from read_ssa_enriched_events()
  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
  dest_user_id), body=create_map(["event_id", event_id,  "process_name", process_name,
  "parent_process_name", parent_process, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting sysmon logs. This search has been modified
+how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified
  to process raw sysmon data from attack_range's nxlogs on DSP.
 known_false_positives: There are circumstances where an application may legitimately
-  execute and interact with the Windows command-line interface. Investigate and modify
-  the lookup file, as appropriate.
-references: []
+  execute and interact with the Windows command-line interface. 
+references:
+  - https://attack.mitre.org/techniques/T1059/
 tags:
  analytic_story:
  - Suspicious Command-Line Executions
-  - Suspicious MSHTA Activity
-  - Suspicious Zoom Child Processes
-  - Sunburst Malware
  cis20:
  - CIS 8
  confidence: 50
  context:
-  - Source:AD
  - Source:Endpoint
-  - Stage:Command And Control
-  - Consequence:Loss Of Control
+  - Stage:Defense Evasion
  impact: 70
  kill_chain_phases:
  - Exploitation
-  message: Potential malicious landing to the console via unexpected programs that
-    called cmd.exe.  Operation is performed at the device $dest_device_id$, by the
-    account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event that warrants investigating.
  mitre_attack_id:
  - T1059
  nist:
@@ -67,10 +57,14 @@ tags:
    type: Hostname
    role:
    - Victim
-  - name: cmd_line
-    type: processname
+  - name: parent_process_name
+    type: Parent Process
    role:
-    - Others
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
  product:
  - Splunk Behavioral Analytics
  required_fields:
@@ -79,6 +73,6 @@ tags:
  - _time
  - dest_device_id
  - dest_user_id
-  risk_score: 56
+  risk_score: 35
  risk_severity: low
  security_domain: endpoint
@@ -57,5 +57,5 @@ sidebar:
 | [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) |
 | [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) |
+| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
 | [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
@@ -134,7 +134,7 @@ sidebar:
 | [Deleting Of Net Users](/endpoint/deleting_of_net_users/) | [Account Access Removal](/tags/#account-access-removal) | TTP |
 | [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [Deny Permission using Cacls Utility](/endpoint/deny_permission_using_cacls_utility/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
-| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
+| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
 | [Detect AWS Console Login by New User]() | None | Hunting |
 | [Detect AWS Console Login by User from New City](/cloud/detect_aws_console_login_by_user_from_new_city/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting |
 | [Detect AWS Console Login by User from New Country](/cloud/detect_aws_console_login_by_user_from_new_country/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting |
@@ -159,7 +159,7 @@ sidebar:
 | [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP |
 | [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP |
 | [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP |
-| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
+| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
 | [Detect Kerberoasting](/endpoint/detect_kerberoasting/) | [Kerberoasting](/tags/#kerberoasting), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP |
 | [Detect Large Outbound ICMP Packets](/network/detect_large_outbound_icmp_packets/) | [Non-Application Layer Protocol](/tags/#non-application-layer-protocol) | TTP |
 | [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP |
@@ -174,9 +174,9 @@ sidebar:
 | [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP |
 | [Detect Pass the Hash](/endpoint/detect_pass_the_hash/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP |
 | [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
-| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
-| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP |
+| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
 | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting |
+| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly |
 | [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
 | [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP |
 | [Detect Rare Executables]() | None | Anomaly |
@@ -191,7 +191,7 @@ sidebar:
 | [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting |
 | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Hunting |
 | [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting |
-| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle) | TTP |
+| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle) | TTP |
 | [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
@@ -662,8 +662,11 @@ sidebar:
 | [Wevtutil Usage To Disable Logs](/endpoint/wevtutil_usage_to_disable_logs/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP |
 | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
+| [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | Hunting |
 | [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
 | [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP |
+| [Windows Curl Download to Suspicious Path](/endpoint/windows_curl_download_to_suspicious_path/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
+| [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP |
 | [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | TTP |
@@ -19,7 +19,7 @@ sidebar:
 | [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | [Initial Access](/tags/#initial-access) |
 | [FIN7](/stories/fin7/) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
 | [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) |
-| [IcedID](/stories/icedid/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) |
+| [IcedID](/stories/icedid/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
 | [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
 | [Ransomware](/stories/ransomware/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Ransomware Cloud](/stories/ransomware_cloud/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
@@ -11,3 +11,13 @@ sidebar:
 | Name    | Detections | Type        |
 | --------| ---------- | ----------- |
 | [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/detections/TTP/conti_common_exec_parameter)| Response |
+| [Risk Notable Block Indicators](/playbooks/risk_notable_block_indicators/)| None | Response |
+| [Risk Notable Enrich](/playbooks/risk_notable_enrich/)| None | Investigation |
+| [Risk Notable Import Data](/playbooks/risk_notable_import_data/)| None | Investigation |
+| [Risk Notable Investigate](/playbooks/risk_notable_investigate/)| None | Investigation |
+| [Risk Notable Merge Events](/playbooks/risk_notable_merge_events/)| None | Investigation |
+| [Risk Notable Mitigate](/playbooks/risk_notable_mitigate/)| None | Response |
+| [Risk Notable Preprocess](/playbooks/risk_notable_preprocess/)| None | Investigation |
+| [Risk Notable Protect Assets and Users](/playbooks/risk_notable_protect_assets_and_users/)| None | Response |
+| [Risk Notable Review Indicators](/playbooks/risk_notable_review_indicators/)| None | Response |
+| [Risk Notable Verdict](/playbooks/risk_notable_verdict/)| None | Response |
@@ -50,7 +50,7 @@ sidebar:
 | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
 | [HAFNIUM Group](hafnium_group) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
 | [Hidden Cobra Malware](hidden_cobra_malware) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) |
-| [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) |
+| [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
 | [Ingress Tool Transfer](ingress_tool_transfer) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) |
 | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
@@ -110,7 +110,7 @@ sidebar:
 | [Windows Discovery Techniques](windows_discovery_techniques) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) |
 | [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Log Manipulation](windows_log_manipulation) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) |
+| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
 | [Windows Privilege Escalation](windows_privilege_escalation) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
 | [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
 | [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
@@ -699,6 +699,9 @@ This playbook investigates and contains ransomware detected on endpoints.



+
+
+



@@ -0,0 +1,45 @@
+---
+title: "Risk Notable Block Indicators"
+last_modified_at: 2021-10-22
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - None
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook handles locating indicators marked for blocking and determining if any blocking playbooks exist. If there is a match to the appropriate tags in the playbook, a filter block routes the name of the playbook to launch to a code block.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar)
+- **Last Updated**: 2021-10-22
+- **Author**: Kelby Shelton, Splunk
+- **ID**: rn0edc96-ff2b-48b0-9f6f-83da3783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+None
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_block_indicators.png)
+
+#### Required field
+
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system)
+* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_block_indicators.yml) \| *version*: **1**
@@ -0,0 +1,44 @@
+---
+title: "Risk Notable Enrich"
+last_modified_at: 2021-10-22
+toc: true
+toc_label: ""
+tags:
+  - Investigation
+  - Splunk SOAR
+  - None
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook collects the available Indicator data types within the event as well as available investigative playbooks. It will launch any playbooks that meet the filtered criteria.
+
+- **Type**: Investigation
+- **Product**: Splunk SOAR
+- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar)
+- **Last Updated**: 2021-10-22
+- **Author**: Kelby Shelton, Splunk
+- **ID**: rn0edc96-ff2b-48b0-9f6f-43da3783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+None
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_enrich.png)
+
+#### Required field
+
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_enrich.yml) \| *version*: **1**
@@ -0,0 +1,53 @@
+---
+title: "Risk Notable Import Data"
+last_modified_at: 2021-10-22
+toc: true
+toc_label: ""
+tags:
+  - Investigation
+  - Splunk SOAR
+  - Splunk
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook gathers all of the events associated with the risk notable and imports them as artifacts. It also generates a custom markdown formatted note.
+
+- **Type**: Investigation
+- **Product**: Splunk SOAR
+- **Apps**: [Splunk](https://splunkbase.splunk.com/apps/#/search/Splunk/product/soar)
+- **Last Updated**: 2021-10-22
+- **Author**: Kelby Shelton, Splunk
+- **ID**: rn0edc96-ff2b-48b0-9f6f-23da3783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+&#39;The Splunk search used to locate contributing events requires three fields in the notable artifact\: risk_object, info_min_time, and info_max_time. The query also performs some deduplication on contributing events and may need to be adjusted based on individual Enterprise Security environments. Mitre Tactics and Techniques appear if using the annotation framework in Splunk ES.&#34;
+index=risk risk_object=\&#34;{0}\&#34; earliest=\&#34;{1}\&#34; latest=&#34;{2}\&#34; | rex field=source \&#34;.*-\s(?&lt;source&gt;.*)\s+-\s+\w+\s+-\s+Rule\&#34; | fillnull value=\&#34;unknown\&#34; threat_object | eval risk_message=coalesce(risk_message,source) | stats values(*) as * by _time source threat_object risk_message | rename annotations.mitre_attack.mitre_technique_id as mitre_technique_id annotations.mitre_attack.mitre_tactic as mitre_tactic annotations.mitre_attack.mitre_technique as mitre_technique | fields - annotations* risk_object_* date_* orig_* user_* src_user_* src_* dest_* dest_user_* info_* search_* splunk_* tag* risk_modifier* risk_rule* sourcetype timestamp index next_cron_time timeendpos timestartpos testmode linecount | sort + _time | \`uitime(_time)\` | dedup source threat_object
+A custom code block sorts the returned event data and produces a markdown formatted note into the note_content output field. This field is then available for use in downstream playbooks.&#34;&#39;
+
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_import_data.png)
+
+#### Required field
+* event_id
+* info_min_time
+* info_max_time
+* risk_object
+* risk_object_type
+
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack)
+* [http://docs.splunk.com/Documentation/ES/6.6.2/Admin/Configurecorrelationsearches#Use_security_framework_annotations_in_correlation_searches](http://docs.splunk.com/Documentation/ES/6.6.2/Admin/Configurecorrelationsearches#Use_security_framework_annotations_in_correlation_searches)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_import_data.yml) \| *version*: **1**
@@ -0,0 +1,44 @@
+---
+title: "Risk Notable Investigate"
+last_modified_at: 2021-10-22
+toc: true
+toc_label: ""
+tags:
+  - Investigation
+  - Splunk SOAR
+  - None
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook checks for the presence of the Risk Investigation workbook and updates tasks or leaves generic notes.
+
+- **Type**: Investigation
+- **Product**: Splunk SOAR
+- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar)
+- **Last Updated**: 2021-10-22
+- **Author**: Kelby Shelton, Splunk
+- **ID**: rn0edc96-ff2b-48b0-9f6f-03da3783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+Set this playbook to run in Active mode on the Risk Notable label in Splunk SOAR.
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_investigate.png)
+
+#### Required field
+
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_investigate.yml) \| *version*: **1**
@@ -0,0 +1,44 @@
+---
+title: "Risk Notable Merge Events"
+last_modified_at: 2021-10-22
+toc: true
+toc_label: ""
+tags:
+  - Investigation
+  - Splunk SOAR
+  - None
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook finds related events based on key fields in a risk notable and allows the user to process the results and decide which events to merge into the current investigation.
+
+- **Type**: Investigation
+- **Product**: Splunk SOAR
+- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar)
+- **Last Updated**: 2021-10-22
+- **Author**: Kelby Shelton, Splunk
+- **ID**: rn0edc96-ff2b-48b0-9f6f-53da3783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+Combining the list_merge utility within the playbook with the find_related_containers utility allows for fine-tuning of related event criteria. For example, the default filtering criteria uses description, risk_object, and threat_object as the important fields and requires at least three matches before an event is considered related. There are several options to customize the associated criteria, including adding more fields in list_merge, reducing or increasing the minimum match count, or utilizing the wildcard feature of find_related_containers.
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_merge_events.png)
+
+#### Required field
+
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_merge_events.yml) \| *version*: **1**
@@ -0,0 +1,47 @@
+---
+title: "Risk Notable Mitigate"
+last_modified_at: 2021-10-22
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - N
+  - o
+  - n
+  - e
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook checks for the presence of the Risk Response workbook and updates tasks or leaves generic notes. The risk_notable_verdict playbooks recommends this playbook as a second phase of the investigation. Additionally, this playbook can be used in ad-hoc investigations or incorporated into custom workbooks.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [N](https://splunkbase.splunk.com/apps/#/search/N/product/soar), [o](https://splunkbase.splunk.com/apps/#/search/o/product/soar), [n](https://splunkbase.splunk.com/apps/#/search/n/product/soar), [e](https://splunkbase.splunk.com/apps/#/search/e/product/soar)
+- **Last Updated**: 2021-10-22
+- **Author**: Kelby Shelton, Splunk
+- **ID**: rn0edc96-ff2b-48b0-9f6f-63da3783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_mitigate.png)
+
+#### Required field
+
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_mitigate.yml) \| *version*: **1**
@@ -0,0 +1,48 @@
+---
+title: "Risk Notable Preprocess"
+last_modified_at: 2021-10-22
+toc: true
+toc_label: ""
+tags:
+  - Investigation
+  - Splunk SOAR
+  - Splunk
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+&#34;This playbook prepares a risk notable for investigation by performing the following tasks: 1. Ensures that a risk notable links back to the original notable event with a card pinned to the HUD. 2. Posts a link to this container in the comment field of Splunk ES. 3. Updates the container name, description, and severity to reflect the data in the notable artifact.&#34;
+
+
+- **Type**: Investigation
+- **Product**: Splunk SOAR
+- **Apps**: [Splunk](https://splunkbase.splunk.com/apps/#/search/Splunk/product/soar)
+- **Last Updated**: 2021-10-22
+- **Author**: Kelby Shelton, Splunk
+- **ID**: rn0edc96-ff2b-48b0-9f6f-13da3783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+None
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_preprocess.png)
+
+#### Required field
+* event_id
+* info_min_time
+* info_max_time
+
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_preprocess.yml) \| *version*: **1**
@@ -0,0 +1,44 @@
+---
+title: "Risk Notable Protect Assets and Users"
+last_modified_at: 2021-10-22
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - None
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook attempts to find assets and users from the notable event and match those with assets and identities from Splunk ES. If a match was found and the user has playbooks available to contain entities, the analyst decides which entities to disable or quarantine.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar)
+- **Last Updated**: 2021-10-22
+- **Author**: Kelby Shelton, Splunk
+- **ID**: rn0edc96-ff2b-48b0-9f6f-93da3783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_protect_assets_and_users.png)
+
+#### Required field
+
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_protect_assets_and_users.yml) \| *version*: **1**
@@ -0,0 +1,44 @@
+---
+title: "Risk Notable Review Indicators"
+last_modified_at: 2021-10-22
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - None
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook was designed to be called by a user to process indicators that are marked as suspicious within the SOAR platform. Analysts will review indicators in a prompt and mark them as blocked or safe.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar)
+- **Last Updated**: 2021-10-22
+- **Author**: Kelby Shelton, Splunk
+- **ID**: rn0edc96-ff2b-48b0-9f6f-73da3783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_review_indicators.png)
+
+#### Required field
+
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_review_indicators.yml) \| *version*: **1**
@@ -0,0 +1,44 @@
+---
+title: "Risk Notable Verdict"
+last_modified_at: 2021-10-22
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - None
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook locates available playbooks with the response tag and presents them to the analyst. Based on the analyst selection, it will launch its chosen playbook.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar)
+- **Last Updated**: 2021-10-22
+- **Author**: Kelby Shelton, Splunk
+- **ID**: rn0edc96-ff2b-48b0-9f6f-33da3783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_verdict.png)
+
+#### Required field
+
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_verdict.yml) \| *version*: **1**
@@ -1,6 +1,6 @@
 ---
 title: "Detect ARP Poisoning"
-excerpt: "Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning"
+excerpt: "Hardware Additions, Network Denial of Service, Man-in-the-Middle, ARP Cache Poisoning"
 categories:
  - Network
 last_modified_at: 2020-08-11
@@ -11,7 +11,7 @@ tags:
  - Initial Access
  - Network Denial of Service
  - Impact
-  - Adversary-in-the-Middle
+  - Man-in-the-Middle
  - Credential Access
  - Collection
  - ARP Cache Poisoning
@@ -48,7 +48,7 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza

 | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |

-| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Credential Access, Collection |
+| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection |

 | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection |

@@ -1,6 +1,6 @@
 ---
 title: "Detect Rogue DHCP Server"
-excerpt: "Hardware Additions, Network Denial of Service, Adversary-in-the-Middle"
+excerpt: "Hardware Additions, Network Denial of Service, Man-in-the-Middle"
 categories:
  - Network
 last_modified_at: 2020-08-11
@@ -11,7 +11,7 @@ tags:
  - Initial Access
  - Network Denial of Service
  - Impact
-  - Adversary-in-the-Middle
+  - Man-in-the-Middle
  - Credential Access
  - Collection
  - Splunk Enterprise
@@ -45,7 +45,7 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization&#39;

 | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |

-| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Credential Access, Collection |
+| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection |

 #### Search

@@ -1,6 +1,6 @@
 ---
 title: "Detect IPv6 Network Infrastructure Threats"
-excerpt: "Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning"
+excerpt: "Hardware Additions, Network Denial of Service, Man-in-the-Middle, ARP Cache Poisoning"
 categories:
  - Network
 last_modified_at: 2020-10-28
@@ -11,7 +11,7 @@ tags:
  - Initial Access
  - Network Denial of Service
  - Impact
-  - Adversary-in-the-Middle
+  - Man-in-the-Middle
  - Credential Access
  - Collection
  - ARP Cache Poisoning
@@ -48,7 +48,7 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz

 | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |

-| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Credential Access, Collection |
+| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection |

 | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection |

@@ -1,6 +1,6 @@
 ---
 title: "Detect Port Security Violation"
-excerpt: "Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning"
+excerpt: "Hardware Additions, Network Denial of Service, Man-in-the-Middle, ARP Cache Poisoning"
 categories:
  - Network
 last_modified_at: 2020-10-28
@@ -11,7 +11,7 @@ tags:
  - Initial Access
  - Network Denial of Service
  - Impact
-  - Adversary-in-the-Middle
+  - Man-in-the-Middle
  - Credential Access
  - Collection
  - ARP Cache Poisoning
@@ -48,7 +48,7 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa

 | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |

-| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Credential Access, Collection |
+| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection |

 | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection |

@@ -0,0 +1,109 @@
+---
+title: "Windows Curl Download to Suspicious Path"
+excerpt: "Ingress Tool Transfer"
+categories:
+  - Endpoint
+last_modified_at: 2021-10-19
+toc: true
+toc_label: ""
+tags:
+  - Ingress Tool Transfer
+  - Command And Control
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the use of Windows Curl.exe downloading a file to a suspicious location. \
+-O or --output is used when a file is to be downloaded and placed in a specified location. \
+During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze.
+
+- **Type**: TTP
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2021-10-19
+- **Author**: Michael Haag, Splunk
+- **ID**: c32f091e-30db-11ec-8738-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process IN ("*-O *","*--output*") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_curl_download_to_suspicious_path_filter`
+```
+
+#### Associated Analytic Story
+* [IceID](/stories/iceid)
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+#### Known False Positives
+It is possible Administrators or super users will use Curl for legitimate purposes. Filter as needed.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory. |
+
+
+
+
+#### Reference
+
+* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
+* [https://attack.mitre.org/techniques/T1105/](https://attack.mitre.org/techniques/T1105/)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_curl_download_to_suspicious_path.yml) \| *version*: **1**
@@ -0,0 +1,102 @@
+---
+title: "WinEvent Windows Task Scheduler Event Action Started"
+excerpt: "Scheduled Task"
+categories:
+  - Endpoint
+last_modified_at: 2021-10-19
+toc: true
+toc_label: ""
+tags:
+  - Scheduled Task
+  - Execution
+  - Persistence
+  - Privilege Escalation
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed). It is recommended to filter based on ActionName by specifying specific paths not used in your environment. After some basic tuning, this may be effective in capturing evasive ways to register tasks on Windows. Review parallel events related to tasks being scheduled. EventID 106 will generate when a new task is generated, however, that does not mean it ran. Capture any files on disk and analyze.
+
+- **Type**: Hunting
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2021-10-19
+- **Author**: Michael Haag, Splunk
+- **ID**: b3632472-310b-11ec-9aab-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+#### Search
+
+```
+`wineventlog_task_scheduler` EventCode IN ("200","201") 
+| rename ComputerName as dest 
+| stats count min(_time) as firstTime max(_time) as lastTime by Message dest EventCode category 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `winevent_windows_task_scheduler_event_action_started_filter`
+```
+
+#### Associated Analytic Story
+* [IcedID](/stories/icedid)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
+#### How To Implement
+Task Scheduler logs are required to be collected. Enable logging with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] and renderXml=false. Note, not translating it in XML may require a proper extraction of specific items in the Message.
+
+#### Required field
+* _time
+* TaskName
+* ActionName
+* EventID
+* dest
+* ProcessID
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+#### Known False Positives
+False positives will be present. Filter based on ActionName paths or specify keywords of interest.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | A Scheduled Task was scheduled and ran on $dest$. |
+
+
+
+
+#### Reference
+
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md)
+* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/windows_taskschedule/windows-taskschedule.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/windows_taskschedule/windows-taskschedule.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml) \| *version*: **1**
@@ -3,7 +3,7 @@ title: "Detect Prohibited Applications Spawning cmd exe"
 excerpt: "Command and Scripting Interpreter"
 categories:
  - Endpoint
-last_modified_at: 2020-7-13
+last_modified_at: 2021-11-10
 toc: true
 toc_label: ""
 tags:
@@ -18,12 +18,12 @@ tags:

 #### Description

-This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe` by @bpatel.
+The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further.

- **Type**: TTP
+- **Type**: Anomaly
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: 
- **Last Updated**: 2020-7-13
+- **Last Updated**: 2021-11-10
 - **Author**: Ignacio Bermudez Corrales, Splunk
 - **ID**: c10a18cb-fd80-4ffa-a844-25026e0a0c94

@@ -53,13 +53,10 @@ This search looks for executions of cmd.exe spawned by a process that is often a

 #### Associated Analytic Story
 * [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
-* [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity)
-* [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes)
-* [Sunburst Malware](/stories/sunburst_malware)


 #### How To Implement
-You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range&#39;s nxlogs on DSP.
+In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range&#39;s nxlogs on DSP.

 #### Required field
 * process_name
@@ -74,20 +71,23 @@ You must be ingesting sysmon logs. This search has been modified to process raw


 #### Known False Positives
-There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. Investigate and modify the lookup file, as appropriate.
+There are circumstances where an application may legitimately execute and interact with the Windows command-line interface.


 #### RBA

 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 56.0 | 70 | 80 | Potential malicious landing to the console via unexpected programs that called cmd.exe.  Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. |
+| 35.0 | 70 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event that warrants investigating. |




 #### Reference

+* [https://attack.mitre.org/techniques/T1059/](https://attack.mitre.org/techniques/T1059/)
+
+

 #### Test Dataset
 Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
@@ -96,4 +96,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith



-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml) \| *version*: **2**
@@ -0,0 +1,110 @@
+---
+title: "Windows Curl Upload to Remote Destination"
+excerpt: "Ingress Tool Transfer"
+categories:
+  - Endpoint
+last_modified_at: 2021-11-10
+toc: true
+toc_label: ""
+tags:
+  - Ingress Tool Transfer
+  - Command And Control
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \
+`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \
+`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \
+HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \
+Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt). During triage, review parallel processes for further behavior. In addition, identify if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.
+
+- **Type**: TTP
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2021-11-10
+- **Author**: Michael Haag, Splunk
+- **ID**: 42f8f1a2-4228-11ec-aade-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_curl_upload_to_remote_destination_filter`
+```
+
+#### Associated Analytic Story
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### Kill Chain Phase
+* Exfiltration
+
+
+#### Known False Positives
+False positives may be limited to source control applications and may be required to be filtered out.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ uploading a file to a remote destination. |
+
+
+
+
+#### Reference
+
+* [https://everything.curl.dev/usingcurl/uploads](https://everything.curl.dev/usingcurl/uploads)
+* [https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409](https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409)
+* [https://twitter.com/d1r4c/status/1279042657508081664?s=20](https://twitter.com/d1r4c/status/1279042657508081664?s=20)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_curl_upload_to_remote_destination.yml) \| *version*: **1**
@@ -56,6 +56,7 @@ IcedId banking trojan campaigns targeting banks and other vertical sectors.This
 | [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
+| [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | Hunting |

 #### Reference

@@ -36,6 +36,8 @@ Ingress tool transfer is a Technique under tactic Command and Control. Behaviors
 | [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [CertUtil Download With VerifyCtl and Split Arguments](/endpoint/certutil_download_with_verifyctl_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
+| [Windows Curl Download to Suspicious Path](/endpoint/windows_curl_download_to_suspicious_path/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
+| [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |

 #### Reference

@@ -32,11 +32,11 @@ This Analytic Story helps you gain a better understanding of how your network de

 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
-| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
-| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
+| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
+| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
 | [Detect New Login Attempts to Routers](/application/detect_new_login_attempts_to_routers/) |  | TTP |
-| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
-| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle) | TTP |
+| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
+| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle) | TTP |
 | [Detect Software Download To Network Device](/network/detect_software_download_to_network_device/) | [TFTP Boot](/tags/#tftp-boot), [Pre-OS Boot](/tags/#pre-os-boot) | TTP |
 | [Detect Traffic Mirroring](/network/detect_traffic_mirroring/) | [Hardware Additions](/tags/#hardware-additions), [Automated Exfiltration](/tags/#automated-exfiltration), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | TTP |

@@ -30,8 +30,8 @@ The ability to execute arbitrary commands via the Windows CLI is a primary goal

 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
-| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP |
 | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting |
+| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly |
 | [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | TTP |
 | [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP |
 | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) |  | Anomaly |
@@ -43,7 +43,6 @@ The objective of this step is to confirm the executed script code is benign or m
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP |
-| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP |
 | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting |
 | [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP |
 | [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP |
@@ -31,7 +31,6 @@ Current detections focus on finding new child processes of this application on a

 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
-| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP |
 | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting |
 | [First Time Seen Child Process of Zoom](/endpoint/first_time_seen_child_process_of_zoom/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | Anomaly |

@@ -61,6 +61,7 @@ Maintaining persistence is one of the first steps taken by attackers after the i
 | [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
+| [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | Hunting |

 #### Reference

@@ -9,12 +9,12 @@ header:
  actions:
    - label: "Download"
      url: "https://splunkbase.splunk.com/app/3449/"
-excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **672** detections for Splunk."
+excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **675** detections for Splunk."
 feature_row:
  - image_path: /static/feature_detection.png
    alt: "customizable"
    title: "Detections"
-    excerpt: "See all **672** Splunk Analytics built to find evil 😈."
+    excerpt: "See all **675** Splunk Analytics built to find evil 😈."
    url: "/detections"
    btn_class: "btn--primary"
    btn_label: "Explore"
@@ -28,7 +28,7 @@ feature_row:
  - image_path: /static/feature_playbooks.png
    alt: "100% free"
    title: "Playbooks"
-    excerpt: "See all **1** sets of steps 🐾 to automatically response to a threat."
+    excerpt: "See all **11** sets of steps 🐾 to automatically response to a threat."
    url: "/playbooks"
    btn_class: "btn--primary"
    btn_label: "Explore"
@@ -3,7 +3,7 @@ tests:
 - name: Office Application Drop Executable
  file: endpoint/office_application_drop_executable.yml
  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
+  earliest_time: '-120d'
  latest_time: 'now'
  attack_data:
  - file_name: sysmon.log
@@ -1,7 +1,7 @@
-name: Regsvr32 Silent Param Dll Loading Unit Test
+name: Regsvr32 Silent and Install Param Dll Loading Unit Test
 tests:
- name: Regsvr32 Silent Param Dll Loading
-  file: endpoint/regsvr32_silent_param_dll_loading.yml
+- name: Regsvr32 Silent and Install Param Dll Loading
+  file: endpoint/regsvr32_silent_and_install_param_dll_loading.yml
  pass_condition: '| stats count | where count > 0'
  earliest_time: '-24h'
  latest_time: 'now'
@@ -1,9 +1,9 @@
-name: Suspicious IcedID Regsvr32 Cmdline Unit Test
+name: Regsvr32 with Known Silent Switch Cmdline Unit Test
 tests:
- name: Suspicious IcedID Regsvr32 Cmdline
-  file: endpoint/suspicious_icedid_regsvr32_cmdline.yml
+- name: Regsvr32 with Known Silent Switch Cmdline
+  file: endpoint/regsvr32_with_known_silent_switch_cmdline.yml
  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
+  earliest_time: '-150d'
  latest_time: 'now'
  attack_data:
  - file_name: windows-sysmon.log
@@ -1,10 +1,10 @@
 name: Detect Prohibited Applications Spawning cmd exe Unit Test
 tests:
-  - name: Access LSASS Memory for Dump Creation
+  - name: Detect Prohibited Applications Spawning cmd exe
    file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
    pass_condition: '@count_gt(0)'
-    description: Test credential dumping detections
+    description: Detect Prohibited Applications Spawning cmd exe
    attack_data:
      - file_name: windows-security.log
        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
-        source: WinEventLog:Security
+        source: WinEventLog:Security
				`@@ -699,6 +699,9 @@ This playbook investigates and contains ransomware detected on endpoints.`