Merge branch 'develop' into revamp_content_ctl

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -30,6 +30,7 @@ tags:
   - Windows Registry Abuse
   - Azorult
   - NjRAT
+  - PlugX
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -51,6 +51,7 @@ tags:
   - Data Destruction
   - Warzone RAT
   - NjRAT
+  - PlugX
   asset_type: Endpoint
   automated_detection_testing: passed
   confidence: 50

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -63,6 +63,7 @@ tags:
   - BlackByte Ransomware
   - Warzone RAT
   - NjRAT
+  - PlugX
   asset_type: Endpoint
   confidence: 50
   impact: 40

detections/endpoint/firewall_allowed_program_enable.yml

@@ -39,6 +39,7 @@ tags:
   - Azorult
   - BlackByte Ransomware
   - NjRAT
+  - PlugX
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/network_connection_discovery_with_netstat.yml

@@ -38,6 +38,7 @@ tags:
   - Windows Post-Exploitation
   - Prestige Ransomware
   - Volt Typhoon
+  - PlugX
   asset_type: Endpoint
   confidence: 50
   impact: 30

detections/endpoint/office_application_drop_executable.yml

@@ -40,6 +40,7 @@ tags:
   - AgentTesla
   - CVE-2023-21716 Word RTF Heap Corruption
   - Warzone RAT
+  - PlugX
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/office_document_executing_macro_code.yml

@@ -41,6 +41,7 @@ tags:
   - Qakbot
   - Azorult
   - Remcos
+  - PlugX
   asset_type: Endpoint
   confidence: 50
   impact: 70

detections/endpoint/office_document_spawned_child_process_to_download.yml

@@ -37,6 +37,7 @@ tags:
   analytic_story:
   - Spearphishing Attachments
   - CVE-2023-36884 Office and Windows HTML RCE Vulnerability
+  - PlugX
   asset_type: Endpoint
   confidence: 50
   impact: 70

detections/endpoint/office_product_spawn_cmd_process.yml

@@ -49,6 +49,7 @@ tags:
   - CVE-2023-21716 Word RTF Heap Corruption
   - CVE-2023-36884 Office and Windows HTML RCE Vulnerability
   - Warzone RAT
+  - PlugX
   asset_type: Endpoint
   confidence: 80
   impact: 70

detections/endpoint/suspicious_process_file_path.yml

@@ -71,6 +71,7 @@ tags:
   - Amadey
   - BlackByte Ransomware
   - Warzone RAT
+  - PlugX
   asset_type: Endpoint
   confidence: 50
   impact: 70

detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml

@@ -28,6 +28,7 @@ references: []
 tags:
   analytic_story:
   - Collection and Staging
+  - PlugX
   asset_type: Windows
   confidence: 70
   impact: 40

detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml

@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - Brute Ratel C4
   - AsyncRAT
+  - PlugX
   asset_type: Endpoint
   confidence: 60
   impact: 60

detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml

@@ -26,7 +26,7 @@ references:
 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
 tags:
   analytic_story:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/service_principal_name_added/windows-security.log
+  - Sneaky Active Directory Persistence Tricks
   asset_type: endpoint
   confidence: 50
   impact: 60

detections/endpoint/windows_replication_through_removable_media.yml

@@ -42,6 +42,7 @@ tags:
   analytic_story:
   - Chaos Ransomware
   - NjRAT
+  - PlugX
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/windows_service_created_with_suspicious_service_path.yml

@@ -34,6 +34,7 @@ tags:
   - Qakbot
   - Snake Malware
   - Flax Typhoon
+  - PlugX
   asset_type: Endpoint
   confidence: 80
   impact: 70

detections/endpoint/windows_service_creation_using_registry_entry.yml

@@ -30,6 +30,7 @@ tags:
   - Windows Persistence Techniques
   - Windows Registry Abuse
   - Brute Ratel C4
+  - PlugX
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/windows_service_deletion_in_registry.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Brute Ratel C4
+  - PlugX
   asset_type: Endpoint
   confidence: 30
   impact: 60

detections/web/confluence_data_center_and_server_privilege_escalation.yml

@@ -58,8 +58,3 @@ tests:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/confluence/nginx_plus_kv_confluence.log
     source: nginx:plus:kv
     sourcetype: nginx:plus:kv
-- name: Suricata Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/confluence/confluence_cve-2023-22515.log
-    source: suricata
-    sourcetype: suricata

dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe_browsers.yml

@@ -0,0 +1,57 @@
+name: Detect Prohibited Applications Spawning cmd exe browsers
+id: c10a18cb-fd70-4ffa-a844-25026e0a0c94
+version: 1
+date: '2023-10-26'
+author: Lou Stella, Splunk
+status: validation
+type: Anomaly
+description: The following analytic identifies parent processes that are browsers, spawning cmd.exe. By its very nature,
+  many applications spawn cmd.exe natively or built into macros. Much of this will
+  need to be tuned to further enhance the risk.
+data_source:
+- Windows Security 4688
+search:
+  selection1:
+    actor.process.file.name:
+    - iexplore.exe
+    - opera.exe
+    - firefox.exe
+  selection2:
+    actor.process.file.name: chrome.exe
+  selection3:
+    process.cmd_line: chrome-extension
+  selection4:
+    process.file.name: cmd.exe
+  condition: ((selection1) or (selection2 and not selection3)) and selection4
+how_to_implement: In order to successfully implement this analytic, you will need
+  endpoint process data from a EDR product or Sysmon. This search has been modified
+  to process raw sysmon data from attack_range's nxlogs on DSP.
+known_false_positives: There are circumstances where an application may legitimately
+  execute and interact with the Windows command-line interface.
+references:
+- https://attack.mitre.org/techniques/T1059/
+tags:
+  analytic_story:
+  - Suspicious Command-Line Executions
+  - Insider Threat
+  asset_type: Endpoint
+  confidence: 50
+  impact: 70
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
+    that warrants investigating.
+  mitre_attack_id:
+  - T1059
+  observable: []
+  product:
+  - Splunk Behavioral Analytics
+  required_fields: []
+  kill_chain_phases:
+  - Exploitation
+  risk_score: 35
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ssa_validation/browsers/windows-security.log
+    source: WinEventLog:Security

dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe_office.yml

@@ -0,0 +1,55 @@
+name: Detect Prohibited Applications Spawning cmd exe office
+id: c10a18cb-fd70-4ffa-a844-25026e0b0c94
+version: 1
+date: '2023-10-26'
+author: Lou Stella, Splunk
+status: validation
+type: Anomaly
+description: The following analytic identifies parent processes that are office/productivity applications, spawning cmd.exe. By its very nature,
+  many applications spawn cmd.exe natively or built into macros. Much of this will
+  need to be tuned to further enhance the risk.
+data_source:
+- Windows Security 4688
+search:
+  selection1:
+    actor.process.file.name:
+    - winword.exe
+    - excel.exe
+    - outlook.exe
+    - acrobat.exe
+    - acrord32.exe
+  selection2:
+    process.file.name: cmd.exe
+  condition: selection1 and selection2
+how_to_implement: In order to successfully implement this analytic, you will need
+  endpoint process data from a EDR product or Sysmon. This search has been modified
+  to process raw sysmon data from attack_range's nxlogs on DSP.
+known_false_positives: There are circumstances where an application may legitimately
+  execute and interact with the Windows command-line interface.
+references:
+- https://attack.mitre.org/techniques/T1059/
+tags:
+  analytic_story:
+  - Suspicious Command-Line Executions
+  - Insider Threat
+  asset_type: Endpoint
+  confidence: 50
+  impact: 70
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
+    that warrants investigating.
+  mitre_attack_id:
+  - T1059
+  observable: []
+  product:
+  - Splunk Behavioral Analytics
+  required_fields: []
+  kill_chain_phases:
+  - Exploitation
+  risk_score: 35
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ssa_validation/office/windows-security.log
+    source: WinEventLog:Security

dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe_powershell.yml

@@ -0,0 +1,51 @@
+name: Detect Prohibited Applications Spawning cmd exe powershell
+id: c10a18cb-fd70-4ffa-a844-25126e0b0d94
+version: 1
+date: '2023-10-26'
+author: Lou Stella, Splunk
+status: validation
+type: Anomaly
+description: The following analytic identifies parent processes that are powershell, spawning cmd.exe. By its very nature,
+  many applications spawn cmd.exe natively or built into macros. Much of this will
+  need to be tuned to further enhance the risk.
+data_source:
+- Windows Security 4688
+search:
+  selection1:
+    actor.process.file.name:
+    - powershell.exe
+  selection2:
+    process.file.name: cmd.exe
+  condition: selection1 and selection2
+how_to_implement: In order to successfully implement this analytic, you will need
+  endpoint process data from a EDR product or Sysmon. This search has been modified
+  to process raw sysmon data from attack_range's nxlogs on DSP.
+known_false_positives: There are circumstances where an application may legitimately
+  execute and interact with the Windows command-line interface.
+references:
+- https://attack.mitre.org/techniques/T1059/
+tags:
+  analytic_story:
+  - Suspicious Command-Line Executions
+  - Insider Threat
+  asset_type: Endpoint
+  confidence: 50
+  impact: 70
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
+    that warrants investigating.
+  mitre_attack_id:
+  - T1059
+  observable: []
+  product:
+  - Splunk Behavioral Analytics
+  required_fields: []
+  kill_chain_phases:
+  - Exploitation
+  risk_score: 35
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
+    source: WinEventLog:Security

dist/DA-ESS-ContentUpdate/app.manifest

@@ -1,15 +1,15 @@
 {
   "schemaVersion": "1.0.0", 
   "info": {
-    "title": "ES Content Updates", 
+    "title": "DA-ESS-ContentUpdate", 
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "4.13.0"
+      "version": "4.15.0"
     }, 
     "author": [
       {
-        "name": "Splunk Security Research Team", 
+        "name": "Splunk Threat Research Team", 
         "email": "research@splunk.com", 
         "company": "Splunk"
       }

dist/DA-ESS-ContentUpdate/default/app.conf

@@ -1,10 +1,16 @@
+#############
+# Automatically generated by generator.py in splunk/security_content
+# On Date: 2023-11-01T20:44:08 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: research@splunk.com
+#############
 ## Splunk app configuration file
 
 [install]
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 17306
+build = 20231101204321
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,12 +26,15 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 4.13.0
+version = 4.15.0 
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
 is_visible = true
-label      = ES Content Updates
+label = DA-ESS-ContentUpdate
 
 [package]
 id = DA-ESS-ContentUpdate
+
+
+

dist/DA-ESS-ContentUpdate/default/collections.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-04T22:36:05 UTC
-# Author: Splunk Security Research
+# On Date: 2023-11-01T20:44:08 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 

dist/DA-ESS-ContentUpdate/default/content-version.conf

@@ -0,0 +1,8 @@
+#############
+# Automatically generated by generator.py in splunk/security_content
+# On Date: 2023-11-01T20:44:08 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: research@splunk.com
+#############
+[content-version]
+version = 4.15.0 

dist/DA-ESS-ContentUpdate/default/es_investigations.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-04T22:36:05 UTC
-# Author: Splunk Security Research
+# On Date: 2023-11-01T20:44:08 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 

dist/DA-ESS-ContentUpdate/default/macros.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-04T22:36:05 UTC
-# Author: Splunk Security Research
+# On Date: 2023-11-01T20:44:08 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 
@@ -1573,6 +1573,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[detect_certipy_file_modifications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [detect_computer_changed_with_anonymous_account_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4105,6 +4109,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_domain_admin_impersonation_indicator_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_dotnet_binary_in_non_standard_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4793,6 +4801,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_registry_sip_provider_modification_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_regsvr32_renamed_binary_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4933,6 +4945,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_sip_provider_inventory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_sip_winverifytrust_failed_trust_validation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_snake_malware_file_modification_crmlog_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4989,6 +5009,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_steal_authentication_certificates___esc1_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_steal_authentication_certificates_export_certificate_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5389,6 +5413,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[cisco_ios_xe_implant_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[citrix_adc_and_gateway_unauthorized_data_disclosure_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [citrix_adc_exploitation_cve_2023_3519_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5397,6 +5429,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[confluence_cve_2023_22515_trigger_vulnerability_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[confluence_data_center_and_server_privilege_escalation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5421,6 +5461,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[f5_tmui_authentication_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [fortinet_appliance_auth_bypass_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5457,6 +5501,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[microsoft_sharepoint_server_elevation_of_privilege_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [monitor_web_traffic_for_brand_abuse_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -6131,6 +6179,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = sourcetype=stream:tcp
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[subjectinterfacepackage]
+definition = sourcetype="PwSh:SubjectInterfacePackage"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [suspicious_email_attachments]
 definition = lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true
 description = This macro limits the output to email attachments that have suspicious extensions

dist/DA-ESS-ContentUpdate/default/transforms.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-04T22:36:05 UTC
-# Author: Splunk Security Research
+# On Date: 2023-11-01T20:44:08 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 
@@ -98,6 +98,11 @@ default_match = false
 # description = A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records
 min_matches = 1
 
+[domain_admins]
+filename = domain_admins.csv
+case_sensitive_match = false
+# description = List of domain admins
+
 [domains]
 filename = domains.csv
 # description = A list of domains that can be ignored

dist/DA-ESS-ContentUpdate/default/workflow_actions.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-04T22:36:05 UTC
-# Author: Splunk Security Research
+# On Date: 2023-11-01T20:44:08 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############