deprecate detect_pass_hash

detections/endpoint/ssa___detect_pass_hash.yml

@@ -1,82 +0,0 @@
-name: Detect Pass the Hash
-id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f
-version: 1
-date: '2020-10-21'
-author: Xiao Lin, Splunk
-type: TTP
-datamodel: []
-description: This search looks for specific authentication events from the Windows
-  Security Event logs to detect potential attempts using Pass-the-Hash technique.
-search: ' | from read_ssa_enriched_events()
-
-  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
-  | eval signature_id=map_get(input_event, "signature_id"), authentication_type=map_get(input_event,
-  "authentication_type"), authentication_method=map_get(input_event, "authentication_method"),
-  origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event,
-  "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
-  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
-
-  | where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9"
-  AND authentication_method="seclogo")
-
-  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
-  dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type,
-  "authentication_method", authentication_method]) | into write_ssa_detected_events();'
-how_to_implement: The test data is converted from Windows Security Event logs generated
-  from Attach Range simulation and used in SPL search and extended to SPL2
-known_false_positives: Legitimate logon activity by authorized NTLM systems may be
-  detected by this search. Please investigate as appropriate.
-references:
-- Initial ESCU implementation by Bhavin Patel and Patrick Bareiss
-tags:
-  analytic_story:
-  - Lateral Movement
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 20
-  context:
-  - Source:AD
-  - Source:Endpoint
-  - Stage:Credential Access
-  impact: 80
-  kill_chain_phases:
-  - Actions on Objectives
-  message: Potential use of the pass the hash/token attacks that spoof authentication.
-    Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
-  mitre_attack_id:
-  - T1550
-  - T1550.002
-  nist:
-  - PR.PT
-  - PR.AT
-  - PR.AC
-  - PR.IP
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Actor
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: cmd_line
-    type: processname
-    role:
-    - Others
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - signature_id
-  - authentication_type
-  - _time
-  - authentication_method
-  - origin_device_domain
-  - dest_user_id
-  - dest_device_id
-  risk_score: 16
-  risk_severity: low
-  security_domain: endpoint