updating names

detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml

@@ -1,4 +1,4 @@
-name: Windows IPC Share Accessed On Multiple Hosts
+name: Windows Administrative Shares Accessed On Multiple Hosts
 id: d92f2d95-05fb-48a7-910f-4d3d61ab8655
 version: 1
 date: '2023-03-23'
@@ -6,11 +6,11 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
 description: UPDATE_DESCRIPTION
-search: ' `wineventlog_security`  EventCode=5140 ShareName="\\\\*\\IPC$"
+search: ' `wineventlog_security` EventCode=5140 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$")
   | bucket span=5m _time
   | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, SubjectUserName, ShareName
   | where unique_targets > 40
-  | `windows_ipc_share_accessed_on_multiple_hosts_filter`'
+  | `windows_administrative_shares_accessed_on_multiple_hosts_filter`'
 how_to_implement: UPDATE_HOW_TO_IMPLEMENT
 known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
 references:

detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Privilege Escalation
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_local_administrator_credential_stuffing.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Privilege Escalation
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_powersploit_gpp_discovery.yml

@@ -1,4 +1,4 @@
-name: Windows PowerShell GPP Discovery
+name: Windows PowerSploit GPP Discovery
 id: 0130a0df-83a1-4647-9011-841e950ff302
 version: 1
 date: '2023-03-16'
@@ -12,7 +12,7 @@ description: The following analytic identifies the use of the Get-GPPPassword Po
 search: ' `powershell` EventCode=4104  (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword)
   | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `windows_powershell_gpp_discovery_filter`'
+  | `windows_powersploit_gpp_discovery_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.

detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml

@@ -1,4 +1,4 @@
-name: Windows Rapid Authentication on Multiple Hosts
+name: Windows Rapid Authentication On Multiple Hosts
 id: 62606c77-d53d-4182-9371-b02cdbbbcef7
 version: 1
 date: '2023-03-23'
@@ -21,6 +21,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Privilege Escalation
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   cis20:
   - CIS 3

tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml

@@ -1,7 +1,7 @@
-name: Windows IPC Share Accessed On Multiple Hosts Unit Test
+name: Windows Administrative Shares Accessed On Multiple Hosts Unit Test
 tests:
-- name: Windows IPC Share Accessed On Multiple Hosts
-  file: endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml
+- name: Windows Administrative Shares Accessed On Multiple Hosts
+  file: endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now

tests/endpoint/windows_powersploit_gpp_discovery.test.yml

@@ -1,7 +1,7 @@
-name: Windows PowerShell GPP Discovery Unit Test
+name: Windows PowerSploit GPP Discovery Unit Test
 tests:
-- name: Windows PowerShell GPP Discovery
-  file: endpoint/windows_powershell_gpp_discovery.yml
+- name: Windows PowerSploit GPP Discovery
+  file: endpoint/windows_powersploit_gpp_discovery.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now

tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml

@@ -1,6 +1,6 @@
-name: Windows Rapid Authentication on Multiple Hosts Unit Test
+name: Windows Rapid Authentication On Multiple Hosts Unit Test
 tests:
-- name: Windows Rapid Authentication on Multiple Hosts
+- name: Windows Rapid Authentication On Multiple Hosts
   file: endpoint/windows_rapid_authentication_on_multiple_hosts.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h