Merge branch 'develop' into reg_yml_analytics_updates

2026-06-08 17:32:49 +00:00 · 2022-01-31 11:07:41 -08:00
parent 46f2aeddfb 14c145c133
commit 5eaad1d88b
11 changed files with 381 additions and 132 deletions
@@ -1,135 +1,135 @@
 {
-    "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
-    "commit_hash": null,
-    "container_tag": "latest",
-    "detections_file": null,
-    "detections_list": null,
-    "folders": [
-        "endpoint",
-        "cloud",
-        "network",
-        "web"
-    ],
-    "interactive": false,
-    "local_apps": {
-        "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
-            "app_number": 12,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-amazon-kinesis-firehose_131r7d1d093.tgz"
-        },
-        "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
-            "app_number": 13,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-microsoft-office-365_202.tgz"
-        },
-        "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
-            "app_number": 9,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-stream-forwarders_730.tgz"
-        },
-        "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
-            "app_number": 8,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-stream-wire-data_730.tgz"
-        },
-        "SPLUNK_ADD_ON_FOR_SYSMON_OLD": {
-            "app_number": 1,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-microsoft-sysmon_1062.tgz"
-        },
-        "SPLUNK_ADD_ON_FOR_ZEEK_AKA_BRO": {
-            "app_number": 11,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-zeek-aka-bro_400.tgz"
-        },
-        "SPLUNK_ASX_APP": {
-            "app_number": 17,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/Splunk_ASX-latest.tar.gz"
-        },
-        "SPLUNK_AWS_TA": {
-            "app_number": 4,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-amazon-web-services_510.tgz"
-        },
-        "SPLUNK_CIM_APP": {
-            "app_number": 3,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-common-information-model-cim_4200.tgz"
-        },
-        "SPLUNK_ES_CONTENT_UPDATE": {
-            "app_number": 3449,
-            "app_version": null,
-            "local_path": null
-        },
-        "SPLUNK_LINUX_TA": {
-            "app_number": 14,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-unix-and-linux_820.tgz"
-        },
-        "SPLUNK_MLTK_APP": {
-            "app_number": 6,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-machine-learning-toolkit_521.tgz"
-        },
-        "SPLUNK_NGINX_TA": {
-            "app_number": 15,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-nginx_310.tgz"
-        },
-        "SPLUNK_PYTHON_APP": {
-            "app_number": 5,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/python-for-scientific-computing-for-linux-64-bit_202.tgz"
-        },
-        "SPLUNK_SECURITY_ESSENTIALS": {
-            "app_number": 10,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-security-essentials_333.tgz"
-        },
-        "SPLUNK_STREAM_APP": {
-            "app_number": 7,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-app-for-stream_730.tgz"
-        },
-        "SPLUNK_SYSMON_LINUX_TA_PATCHED": {
-            "app_number": 2,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/add-on-for-linux-sysmon_103_PATCHED.tgz"
-        },
-        "SPLUNK_TA_FOR_ZEEK": {
-            "app_number": 16,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/ta-for-zeek_105.tgz"
-        },
-        "SPLUNK_WINDOWS_TA": {
-            "app_number": 0,
-            "app_version": null,
-            "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-microsoft-windows_812.tgz"
-        }
+  "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
+  "commit_hash": null,
+  "container_tag": "latest",
+  "detections_file": null,
+  "detections_list": null,
+  "folders": [
+    "endpoint",
+    "cloud",
+    "network",
+    "web"
+  ],
+  "interactive": false,
+  "local_apps": {
+    "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
+      "app_number": 12,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-amazon-kinesis-firehose_131r7d1d093.tgz"
    },
-    "local_base_container_name": "splunk_test_%d",
-    "mock": false,
-    "mode": "changes",
-    "no_interactive_failure": true,
-    "num_containers": 10,
-    "persist_security_content": false,
-    "pr_number": null,
-    "reuse_image": true,
-    "show_splunk_app_password": false,
-    "splunk_app_password": null,
-    "splunk_container_apps_directory": "/opt/splunk/etc/apps",
-    "splunkbase_apps": {
-        "SPLUNK_ADD_ON_FOR_SYSMON": {
-            "app_number": 5709,
-            "app_version": "1.0.1"
-        }
+    "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
+      "app_number": 13,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-microsoft-office-365_202.tgz"
    },
-    "splunkbase_password": null,
-    "splunkbase_username": null,
-    "types": [
-        "Anomaly",
-        "Hunting",
-        "TTP"
-    ]
-}
+    "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
+      "app_number": 9,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-stream-forwarders_730.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
+      "app_number": 8,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-stream-wire-data_730.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_SYSMON_OLD": {
+      "app_number": 1,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-microsoft-sysmon_1062.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_ZEEK_AKA_BRO": {
+      "app_number": 11,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-zeek-aka-bro_400.tgz"
+    },
+    "SPLUNK_ASX_APP": {
+      "app_number": 17,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/Splunk_ASX-latest.tar.gz"
+    },
+    "SPLUNK_AWS_TA": {
+      "app_number": 4,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-amazon-web-services_510.tgz"
+    },
+    "SPLUNK_CIM_APP": {
+      "app_number": 3,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-common-information-model-cim_4200.tgz"
+    },
+    "SPLUNK_ES_CONTENT_UPDATE": {
+      "app_number": 3449,
+      "app_version": null,
+      "local_path": null
+    },
+    "SPLUNK_LINUX_TA": {
+      "app_number": 14,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-unix-and-linux_820.tgz"
+    },
+    "SPLUNK_MLTK_APP": {
+      "app_number": 6,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-machine-learning-toolkit_531.tgz"
+    },
+    "SPLUNK_NGINX_TA": {
+      "app_number": 15,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-nginx_310.tgz"
+    },
+    "SPLUNK_PYTHON_APP": {
+      "app_number": 5,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/python-for-scientific-computing-for-linux-64-bit_302.tgz"
+    },
+    "SPLUNK_SECURITY_ESSENTIALS": {
+      "app_number": 10,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-security-essentials_333.tgz"
+    },
+    "SPLUNK_STREAM_APP": {
+      "app_number": 7,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-app-for-stream_730.tgz"
+    },
+    "SPLUNK_SYSMON_LINUX_TA_PATCHED": {
+      "app_number": 2,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/add-on-for-linux-sysmon_103_PATCHED.tgz"
+    },
+    "SPLUNK_TA_FOR_ZEEK": {
+      "app_number": 16,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/ta-for-zeek_105.tgz"
+    },
+    "SPLUNK_WINDOWS_TA": {
+      "app_number": 0,
+      "app_version": null,
+      "http_path": "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com/splunk-add-on-for-microsoft-windows_812.tgz"
+    }
+  },
+  "local_base_container_name": "splunk_test_%d",
+  "mock": false,
+  "mode": "changes",
+  "no_interactive_failure": true,
+  "num_containers": 10,
+  "persist_security_content": false,
+  "pr_number": null,
+  "reuse_image": true,
+  "show_splunk_app_password": false,
+  "splunk_app_password": null,
+  "splunk_container_apps_directory": "/opt/splunk/etc/apps",
+  "splunkbase_apps": {
+    "SPLUNK_ADD_ON_FOR_SYSMON": {
+      "app_number": 5709,
+      "app_version": "1.0.1"
+    }
+  },
+  "splunkbase_password": null,
+  "splunkbase_username": null,
+  "types": [
+    "Anomaly",
+    "Hunting",
+    "TTP"
+  ]
+}
@@ -11,6 +11,7 @@ description: This particular behavior is typically executed when an adversaries
  detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
  task modifications will occur. During triage, review parallel processes and identify
  any further file modifications. Endpoint should be isolated.
+
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
  where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data = 0x00000001 
  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
@@ -0,0 +1,77 @@
+name: Potentially malicious code on commandline
+id: 9c53c446-757e-11ec-871d-acde48001122
+version: 1
+date: '2022-01-14'
+author: Michael Hart, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic uses a pretrained machine learning text classifier
+  to detect potentially malicious commandlines.  The model identifies unusual
+  combinations of keywords found in samples of commandlines where adversaries executed
+  powershell code, primarily for C2 communication.  For example, adversaries will leverage
+  IO capabilities such as "streamreader" and "webclient", threading capabilties such as
+  "mutex" locks, programmatic constructs like "function" and "catch", and cryptographic
+  operations like "computehash".  Although observing one of these keywords in a commandline
+  script is possible, combinations of keywords observed in attack data are not typically
+  found in normal usage of the commandline.  The model will output a score where all values
+  above zero are suspicious, anything greater than one particularly so.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
+  max(_time) as lastTime from datamodel="Endpoint.Processes" by
+  Processes.parent_process_name Processes.process_name Processes.process
+  Processes.user Processes.dest  | `drop_dm_object_name(Processes)`  | where
+  len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score` |
+  apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'',
+  process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits) orig_process |
+  where score > 0.5 | `security_content_ctime(firstTime)` |
+  `security_content_ctime(lastTime)` | `potentially_malicious_code_on_commandline_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.  You
+  will also need to install the Machine Learning Toolkit version 5.3 or above to apply
+  the pretrained model.
+known_false_positives: This model is an anomaly detector that identifies usage of APIs
+  and scripting constructs that are correllated with malicious activity.  These APIs and
+  scripting constructs are part of the programming langauge and advanced scripts may
+  generate false positives.
+references:
+  - https://attack.mitre.org/techniques/T1059/003/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
+tags:
+  analytic_story:
+  - Suspicious Command-Line Executions
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/malicious_cmd_line_samples/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.user
+  - Processes.dest
+  security_domain: endpoint
+  impact: 60
+  confidence: 20
+  risk_score: 12
+  context:
+    - source:endpoint
+    - stage:Execution
+  message: Unusual command-line execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$
+  observable:
+    - name: dest
+      type: Hostname
+      role:
+        - Victim
+    - name: user
+      type: User
+      role:
+        - Victim
@@ -0,0 +1,48 @@
+name: Anomalous Usage of Account Credentials
+id: 629cbf9e-5785-11ec-9611-acde48001122
+version: 1
+date: '2021-12-07'
+author: Lou Stella, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Processes
+description: This is an anomaly generating detection looking for multiple interactive logins within a specific time period. An insider threat may attempt to steal colleagues credentials in low tech, undetectable methods, in order to gain access to additional information or to hide their own behavior. This should capture their attempted use of those credentials on a workstation. 
+search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "dest_user_original_artifact"), "string", null), signature_id=ucast(map_get(input_event, "EventCode"), "string", null) | where signature_id="4624" | where auth_type="2" OR auth_type="11" | where NOT (src_user="SYSTEM") AND NOT (src_user="ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by device, span(timestamp, 600s, 300s) | where user_counter>=2  | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this detection, you need to be ingesting logon events from workstations.
+known_false_positives: Shared workstations can cause false positives
+references:
+-  https://attack.mitre.org/techniques/T1078/002/
+tags:
+  analytic_story:
+  - Insider Threat
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1078.002
+  cis20:
+  - CIS 14
+  nist:
+  - PR.AC
+  - DE.AE
+  product:
+  - Splunk Behavioral Analytics
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_login/windows-security.log
+  required_fields:
+  - _time
+  security_domain: access
+  impact: 20
+  confidence: 30
+  risk_score: 6
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: Multiple interactive logins detected on $device$
+  risk_severity: low
+  observable:
+  - name: device
+    type: Hostname
+    role:
+    - Victim
+  
@@ -0,0 +1,75 @@
+name: Disable Defender AntiVirus Registry
+id: aa4f115a-3024-11ec-9987-acde48001122
+version: 1
+date: '2021-12-08'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel:
+- Endpoint_Registry
+description: This particular behavior is typically executed when an adversaries or
+  malware gains access to an endpoint and beings to perform execution and to evade
+  detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
+  task modifications will occur. During triage, review parallel processes and identify
+  any further file modifications. Endpoint should be isolated.
+search: '| from read_ssa_enriched_events() 
+| eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
+    "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string",
+    null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"), "string",
+    null)), registry_value_data=ucast(map_get(input_event, "registry_value_data"), "string", null),
+    process_guid=ucast(map_get(input_event, "process_guid"), "string",
+    null),
+    event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where like(registry_path, "%\\Policies\\Microsoft\\Windows Defender%")
+    AND registry_key_name="DisableAntiVirus" AND registry_value_data="(0x00000001)"
+| eval start_time=timestamp,
+    end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+    "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+    body=create_map( 
+    [ "event_id", event_id, "registry_path", registry_path, "registry_key_name",
+        registry_key_name, "process_guid", process_guid,"registry_value_data",registry_value_data]) 
+| into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the registry value name, registry path, and registry value data from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Admin or user may choose to disable windows defender product
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IceID
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Modified/added/deleted registry entry $registry_path$ in $dest$
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
+  risk_score: 49
+  security_domain: endpoint
@@ -0,0 +1,6 @@
+description: An MLTK model for detecting malicious commandlines
+filename: __mlspl_unusual_commandline_detection.mlmodel
+name: __mlspl_unusual_commandline_detection
+case_sensitive_match: 'false'
+min_matches: 1
+default_match: 'false'
@@ -0,0 +1,3 @@
+definition: eval orig_process=process, process=replace(lower(process), "`", "") | makemv tokenizer="([\w\d\-]+)" process | eval unusual_cmdline_feature_for=if(match(process, "^for$"), mvcount(mvfilter(match(process, "^for$"))), 0), unusual_cmdline_feature_netsh=if(match(process, "^netsh$"), mvcount(mvfilter(match(process, "^netsh$"))), 0), unusual_cmdline_feature_readbytes=if(match(process, "^readbytes$"), mvcount(mvfilter(match(process, "^readbytes$"))), 0), unusual_cmdline_feature_set=if(match(process, "^set$"), mvcount(mvfilter(match(process, "^set$"))), 0), unusual_cmdline_feature_unrestricted=if(match(process, "^unrestricted$"), mvcount(mvfilter(match(process, "^unrestricted$"))), 0), unusual_cmdline_feature_winstations=if(match(process, "^winstations$"), mvcount(mvfilter(match(process, "^winstations$"))), 0), unusual_cmdline_feature_-value=if(match(process, "^-value$"), mvcount(mvfilter(match(process, "^-value$"))), 0), unusual_cmdline_feature_compression=if(match(process, "^compression$"), mvcount(mvfilter(match(process, "^compression$"))), 0), unusual_cmdline_feature_server=if(match(process, "^server$"), mvcount(mvfilter(match(process, "^server$"))), 0), unusual_cmdline_feature_set-mppreference=if(match(process, "^set-mppreference$"), mvcount(mvfilter(match(process, "^set-mppreference$"))), 0), unusual_cmdline_feature_terminal=if(match(process, "^terminal$"), mvcount(mvfilter(match(process, "^terminal$"))), 0), unusual_cmdline_feature_-name=if(match(process, "^-name$"), mvcount(mvfilter(match(process, "^-name$"))), 0), unusual_cmdline_feature_catch=if(match(process, "^catch$"), mvcount(mvfilter(match(process, "^catch$"))), 0), unusual_cmdline_feature_get-wmiobject=if(match(process, "^get-wmiobject$"), mvcount(mvfilter(match(process, "^get-wmiobject$"))), 0), unusual_cmdline_feature_hklm=if(match(process, "^hklm$"), mvcount(mvfilter(match(process, "^hklm$"))), 0), unusual_cmdline_feature_streamreader=if(match(process, "^streamreader$"), mvcount(mvfilter(match(process, "^streamreader$"))), 0), unusual_cmdline_feature_system32=if(match(process, "^system32$"), mvcount(mvfilter(match(process, "^system32$"))), 0), unusual_cmdline_feature_username=if(match(process, "^username$"), mvcount(mvfilter(match(process, "^username$"))), 0), unusual_cmdline_feature_webrequest=if(match(process, "^webrequest$"), mvcount(mvfilter(match(process, "^webrequest$"))), 0), unusual_cmdline_feature_count=if(match(process, "^count$"), mvcount(mvfilter(match(process, "^count$"))), 0), unusual_cmdline_feature_webclient=if(match(process, "^webclient$"), mvcount(mvfilter(match(process, "^webclient$"))), 0), unusual_cmdline_feature_writeallbytes=if(match(process, "^writeallbytes$"), mvcount(mvfilter(match(process, "^writeallbytes$"))), 0), unusual_cmdline_feature_convert=if(match(process, "^convert$"), mvcount(mvfilter(match(process, "^convert$"))), 0), unusual_cmdline_feature_create=if(match(process, "^create$"), mvcount(mvfilter(match(process, "^create$"))), 0), unusual_cmdline_feature_function=if(match(process, "^function$"), mvcount(mvfilter(match(process, "^function$"))), 0), unusual_cmdline_feature_net=if(match(process, "^net$"), mvcount(mvfilter(match(process, "^net$"))), 0), unusual_cmdline_feature_com=if(match(process, "^com$"), mvcount(mvfilter(match(process, "^com$"))), 0), unusual_cmdline_feature_http=if(match(process, "^http$"), mvcount(mvfilter(match(process, "^http$"))), 0), unusual_cmdline_feature_io=if(match(process, "^io$"), mvcount(mvfilter(match(process, "^io$"))), 0), unusual_cmdline_feature_system=if(match(process, "^system$"), mvcount(mvfilter(match(process, "^system$"))), 0), unusual_cmdline_feature_new-object=if(match(process, "^new-object$"), mvcount(mvfilter(match(process, "^new-object$"))), 0), unusual_cmdline_feature_if=if(match(process, "^if$"), mvcount(mvfilter(match(process, "^if$"))), 0), unusual_cmdline_feature_threading=if(match(process, "^threading$"), mvcount(mvfilter(match(process, "^threading$"))), 0), unusual_cmdline_feature_mutex=if(match(process, "^mutex$"), mvcount(mvfilter(match(process, "^mutex$"))), 0), unusual_cmdline_feature_cryptography=if(match(process, "^cryptography$"), mvcount(mvfilter(match(process, "^cryptography$"))), 0), unusual_cmdline_feature_computehash=if(match(process, "^computehash$"), mvcount(mvfilter(match(process, "^computehash$"))), 0) 
+description: Performs the tokenization and application of the malicious commandline classifier
+name: potentially_malicious_code_on_cmdline_tokenize_score
@@ -0,0 +1,12 @@
+name: Potentially malicious code on commandline Unit Test
+tests:
+- name: Potentially malicious code on commandline
+  file: endpoint/potentially_malicious_code_on_commandline.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-10y'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/malicious_cmd_line_samples/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
@@ -0,0 +1,10 @@
+name: Anomalous Usage of Account Credentials Unit Test
+tests:
+  - name: Anomalous Usage of Account Credentials
+    file: endpoint/ssa___anomalous_usage_of_account_credentials.yml
+    pass_condition: '@count_gt(0)'
+    description: Test for Anomalous usage of Account Credentials
+    attack_data:
+      - file_name: windows-security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_login/windows-security.log
+        source: WinEventLog:Security
@@ -0,0 +1,15 @@
+name: Disable Defender AntiVirus Registry Unit Test - SSA
+tests:
+  - name: Disable Defender AntiVirus Registry
+    file: endpoint/ssa___disable_defender_antivirus_registry.yml
+    pass_condition: '@count_gt(0)'
+    description: Test for Disable Defender AntiVirus Registry
+    attack_data:
+      - file_name: sysmon.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+        sourcetype: xmlwineventlog
+      
+        
+        
+