From f5e121b1ebb5975a81f9a640ddb0ad722376cc78 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 15 May 2023 13:22:04 -0600
Subject: [PATCH 01/12] The Haag Mile: A Journey of Redemption

---
 ...percutng_suspicious_behavior_debug_log.yml | 58 ++++++++++++++++
 .../windows_papercutng_spawn_shell.yml        | 69 +++++++++++++++++++
 .../papercutng_remote_web_access_attempt.yml  | 57 +++++++++++++++
 macros/papercutng.yml                         |  4 ++
 stories/papercut mf_ng_vulnerability.yml      | 32 +++++++++
 5 files changed, 220 insertions(+)
 create mode 100644 detections/application/papercutng_suspicious_behavior_debug_log.yml
 create mode 100644 detections/endpoint/windows_papercutng_spawn_shell.yml
 create mode 100644 detections/web/papercutng_remote_web_access_attempt.yml
 create mode 100644 macros/papercutng.yml
 create mode 100644 stories/papercut mf_ng_vulnerability.yml

diff --git a/detections/application/papercutng_suspicious_behavior_debug_log.yml b/detections/application/papercutng_suspicious_behavior_debug_log.yml
new file mode 100644
index 0000000000..a8c2e4fabf
--- /dev/null
+++ b/detections/application/papercutng_suspicious_behavior_debug_log.yml
@@ -0,0 +1,58 @@
+name: PaperCutNG Suspicious Behavior Debug Log
+id: 395163b8-689b-444b-86c7-9fe9ad624734
+version: 1
+date: '2023-05-15'
+author: Michael Haag, Splunk
+status: production
+type: Hunting
+data_source: []
+description: The following hunting analytic is designed to monitor and detect potential exploitation attempts targeting a PaperCutNG server by analyzing its debug log data. By focusing on public IP addresses accessing the PaperCutNG instance, this analytic aims to identify unauthorized or suspicious access attempts. Furthermore, it searches for specific URIs that have been discovered in the proof of concept code, which are associated with known exploits or vulnerabilities. The analytic is focused on the user admin. Regex is used mainly because the log is not parsed by Splunk and there is no TA for this debug log.
+search: '`papercutng` (loginType=Admin OR userName=admin) 
+  | eval uri_match=if(match(_raw, "(?i)(\/app\?service=page\/SetupCompleted|\/app|\/app\?service=page\/PrinterList|\/app\?service=direct\/1\/PrinterList\/selectPrinter&sp=l1001|\/app\?service=direct\/1\/PrinterDetails\/printerOptionsTab\.tab)"), "URI matches", null())
+  | eval ip_match=if(match(_raw, "(?i)((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))") AND NOT match(_raw, "(?i)(10\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|(172\.(1[6-9]|2[0-9]|3[0-1])\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|(192\.168\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))"), "IP matches", null())
+  | where  (isnotnull(uri_match) OR isnotnull(ip_match))
+  | stats sparkline, count, values(uri_match) AS uri_match, values(ip_match) AS ip_match latest(_raw)
+    BY host, index, sourcetype | `papercutng_suspicious_behavior_debug_log_filter`'
+how_to_implement: Debug logs must be enabled and shipped to Splunk in order to properly identify behavior with this analytic.
+known_false_positives: False positives may be present, as this is based on the admin user accessing the PapercutNG instance from a public IP address. Filter as needed.
+references:
+  - https://www.papercut.com/kb/Main/HowToCollectApplicationServerDebugLogs
+  - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/HAFNIUM.md
+  - https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
+  - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
+  - https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/
+  - https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/
+  - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
+tags:
+  analytic_story:
+  - PaperCutNG MF NG Vulnerability
+  asset_type: Web Server
+  atomic_guid: []
+  confidence: 80
+  impact: 80
+  message: Behavior related to exploitation of PaperCutNG has been identified on $host$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 64
+  required_fields:
+  - uri_match
+  - ip_match
+  - index
+  - sourcetype
+  - host
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/papercut/server.log
+    source: stash
+    sourcetype: stash
diff --git a/detections/endpoint/windows_papercutng_spawn_shell.yml b/detections/endpoint/windows_papercutng_spawn_shell.yml
new file mode 100644
index 0000000000..00d816a3f8
--- /dev/null
+++ b/detections/endpoint/windows_papercutng_spawn_shell.yml
@@ -0,0 +1,69 @@
+name: Windows PaperCutNG Spawn Shell
+id: a602d9a2-aaea-45f8-bf0f-d851168d61ca
+version: 1
+date: '2023-05-15'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 1
+description: The following analytic is designed to detect instances where the PaperCutNG application (pc-app.exe) spawns a Windows shell, specifically cmd.exe or PowerShell. This behavior may indicate potential malicious activity, such as an attacker attempting to gain unauthorized access or execute harmful commands on the affected system.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=pc-app.exe `process_cmd` OR `process_powershell`
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_papercutng_spawn_shell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present, but most likely not. Filter as needed.
+references:
+  - https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
+  - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
+tags:
+  analytic_story:
+  - PaperCutNG MF NG Vulnerability
+  asset_type: Endpoint
+  atomic_guid: []
+  confidence: 90
+  impact: 100
+  message: The PaperCutNG application has spawned a shell $process_name$ on endpoint $dest$ by $user$.
+  mitre_attack_id:
+  - T1059
+  - T1190
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 90
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/papercut/papercutng-app-spawn_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/detections/web/papercutng_remote_web_access_attempt.yml b/detections/web/papercutng_remote_web_access_attempt.yml
new file mode 100644
index 0000000000..3fa6640e2e
--- /dev/null
+++ b/detections/web/papercutng_remote_web_access_attempt.yml
@@ -0,0 +1,57 @@
+name: PaperCutNG Remote Web Access Attempt
+id: 9fcb214a-dc42-4ce7-a650-f1d2cab16a6a
+version: 1
+date: '2023-05-15'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic is designed to detect potential exploitation attempts on publicly accessible PaperCutNG servers. It identifies connections from public IP addresses to the server and specifically monitors for URI paths commonly found in proof-of-concept (POC) scripts for exploiting PaperCutNG vulnerabilities. These URI paths have been observed in both Metasploit modules and standalone scripts used for attacking PaperCutNG servers.
+  When a public IP address is detected accessing one or more of these suspicious URI paths, an alert may be generated to notify the security team of the potential threat. The team can then investigate the source IP address, the targeted PaperCutNG server, and any other relevant information to determine the nature of the activity and take appropriate actions to mitigate the risk.
+search: '| tstats count from datamodel=Web where Web.url IN ("/app?service=page/SetupCompleted", "/app", "/app?service=page/PrinterList", "/app?service=direct/1/PrinterList/selectPrinter&sp=*", "/app?service=direct/1/PrinterDetails/printerOptionsTab.tab") NOT (src IN ("10.*.*.*","172.16.*.*", "192.168.*.*", "169.254.*.*", "127.*.*.*", "fc00::*", "fd00::*", "fe80::*")) by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest Web.dest_port sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `papercutng_remote_web_access_attempt_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on Web traffic that include fields relavent for traffic into the `Web` datamodel.
+known_false_positives: False positives may be present, filter as needed.
+references:
+  - https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
+  - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
+  - https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/
+  - https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/
+  - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
+tags:
+  analytic_story:
+  - PaperCutNG MF NG Vulnerability
+  asset_type: Web Server
+  atomic_guid: []
+  confidence: 70
+  impact: 90
+  message: URIs specific to PaperCutNG have been access by a public IP against $dest$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 63
+  required_fields:
+  - _time
+  - Web.http_user_agent
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - sourcetype
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/papercut/papercutng-suricata.log
+    source: stash
+    sourcetype: stash
diff --git a/macros/papercutng.yml b/macros/papercutng.yml
new file mode 100644
index 0000000000..011e867914
--- /dev/null
+++ b/macros/papercutng.yml
@@ -0,0 +1,4 @@
+definition: sourcetype="papercutng"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: papercutng
diff --git a/stories/papercut mf_ng_vulnerability.yml b/stories/papercut mf_ng_vulnerability.yml
new file mode 100644
index 0000000000..e12771809f
--- /dev/null
+++ b/stories/papercut mf_ng_vulnerability.yml	
@@ -0,0 +1,32 @@
+name: PaperCutNG MF NG Vulnerability
+id: 2493d270-5665-4fb4-99c7-8f886f260676
+version: 1
+date: '2023-05-15'
+author: Michael Haag, Splunk
+description: The FBI has issued a joint advisory concerning the exploitation of a PaperCut MF/NG vulnerability (CVE-2023-27350) by malicious actors, which began in mid-April 2023 and has been ongoing. In early May 2023, a group identifying themselves as the Bl00dy Ransomware Gang targeted vulnerable PaperCut servers within the Education Facilities Subsector. The advisory provides information on detecting exploitation attempts and shares known indicators of compromise (IOCs) associated with the group's activities.
+narrative: 'PaperCut MF/NG versions 19 and older have reached their end-of-life, as documented on the End of Life Policy page. Customers using these older versions are advised to purchase an updated license online for PaperCut NG or through their PaperCut Partner for PaperCut MF. For users with a currently supported version (version 20 or later), they can upgrade to any maintenance release version they are licensed for.
+  If upgrading to a security patch is not possible, there are alternative options to enhance security. Users can lock down network access to their server(s) by blocking all inbound traffic from external IPs to the web management port (port 9191 and 9192 by default) and blocking all inbound traffic to the web management portal on the firewall to the server. Additionally, users can apply "Allow list" restrictions under Options > Advanced > Security > Allowed site server IP addresses, setting this to only allow the IP addresses of verified Site Servers on their network.
+
+  The vulnerabilities CVE-2023-27350 and CVE-2023-27351 have CVSS scores of 9.8 (Critical) and 8.2 (High), respectively. PaperCut and its partner network have activated response teams to assist PaperCut MF and NG customers, with service desks available 24/7 via their support page. The security response team at PaperCut has been working with external security advisors to compile a list of unpatched PaperCut MF/NG servers that have ports open on the public internet. They have been proactively reaching out to potentially exposed customers since Wednesday afternoon (AEST) and are working around the clock through the weekend.
+
+  The exploit was first detected in the wild on April 18th, 2023, at 03:30 AEST / April 17th, 2023, at 17:30 UTC. The earliest signature of suspicious activity on a customer server potentially linked to this vulnerability dates back to April 14th, 2023, at 01:29 AEST / April 13th, 2023, at 15:29 UTC.
+
+  Applying the security fixes should not have any negative impact. Users can follow their usual upgrade procedure to obtain the upgrade. Additional links on the -Check for updates- page (accessed through the Admin interface > About > Version info > Check for updates) allow customers to download fixes for previous major versions that are still supported (e.g., 20.1.7 and 21.2.11) as well as the current version available. PaperCut MF users are advised to follow their regular upgrade process and consult their PaperCut partner or reseller for assistance.'
+references:
+  - https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
+  - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
+  - https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/
+  - https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/
+  - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
+tags:
+  analytic_story: PaperCutNG MF NG Vulnerability
+  cve: 
+  - CVE-2023-27350
+  - CVE-2023-27351
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

From 9e535bb5f012753e1b6335360c738011c764fb29 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 15 May 2023 12:49:18 -0700
Subject: [PATCH 02/12] Update baseline to include suricata ta.  TA required
 for testing new detections. Also, remove some duplicates apps from the
 baseline.

---
 .../modules/validate_args.py                  |  20 +-
 .../test_config_github_actions.json           | 325 +++++++-----------
 2 files changed, 125 insertions(+), 220 deletions(-)

diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py
index 61840da2b1..b4846c693e 100644
--- a/bin/docker_detection_tester/modules/validate_args.py
+++ b/bin/docker_detection_tester/modules/validate_args.py
@@ -54,11 +54,6 @@ setup_schema = {
                     "app_version": "1.0.4",
                     "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz",
                 },
-                "SPLUNK_TA_FIX_WINDOWS": {
-                    "app_number": 9999,
-                    "app_version": "1.0.0",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz",
-                },
                 "SPLUNK_TA_FOR_IIS": {
                     "app_number": 3185,
                     "app_version": "1.2.0",
@@ -124,11 +119,6 @@ setup_schema = {
                     "app_version": "8.1.0",
                     "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz",
                 },
-                "SPLUNK_COMMON_INFORMATION_MODEL": {
-                    "app_number": 1621,
-                    "app_version": "5.1.0",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_510.tgz",
-                },
                 "SPLUNK_MACHINE_LEARNING_TOOLKIT": {
                     "app_number": 2890,
                     "app_version": "5.4.0",
@@ -164,6 +154,16 @@ setup_schema = {
                     "app_version": "2.4.1",
                     "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_241.tgz",
                 },
+                "SPLUNK_TA_FOR_SURICATA": {
+                    "app_number": 2760,
+                    "app_version": "2.3.3",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-suricata_234.tgz",
+                },
+                "SPLUNK_COMMON_INFORMATION_MODEL": {
+                    "app_number": 1621,
+                    "app_version": "5.1.0",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_510.tgz",
+                }
             },
         },
         "mode": {
diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json
index 898ca9183f..b7b05965d7 100644
--- a/bin/docker_detection_tester/test_config_github_actions.json
+++ b/bin/docker_detection_tester/test_config_github_actions.json
@@ -1,220 +1,125 @@
 {
   "apps": {
-      "Splunk Add-on for CrowdStrike FDR": {
-        "app_number": 5579,
-        "app_version": "1.2.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz"
-      },
-      "ADD_ON_FOR_LINUX_SYSMON": {
-        "app_number": 6176,
-        "app_version": "1.0.4",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
-      },
-      "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
-        "app_number": 2757,
-        "app_version": "7.1.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
-      },
-      "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
-        "app_number": 2882,
-        "app_version": "3.0.2",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz"
-      },
-      "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
-        "app_number": 3719,
-        "app_version": "1.3.2",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
-      },
-      "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
-        "app_number": 4055,
-        "app_version": "4.0.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz"
-      },
-      "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
-        "app_number": 742,
-        "app_version": "8.5.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz"
-      },
-      "SPLUNK_ADD_ON_FOR_NGINX": {
-        "app_number": 3258,
-        "app_version": "3.1.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz"
-      },
-      "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
-        "app_number": 5238,
-        "app_version": "8.1.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz"
-      },
-      "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
-        "app_number": 5234,
-        "app_version": "8.1.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz"
-      },
-      "SPLUNK_ADD_ON_FOR_SYSMON": {
-        "app_number": 5709,
-        "app_version": "3.0.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz"
-      },
-      "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
-        "app_number": 833,
-        "app_version": "8.6.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_860.tgz"
-      },
-      "SPLUNK_APP_FOR_STREAM": {
-        "app_number": 1809,
-        "app_version": "8.1.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz"
-      },
-      "SPLUNK_TA_FIX_WINDOWS":{
-        "app_number": 9999,
-        "app_version": "1.0.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz"
-      },
-      "SPLUNK_COMMON_INFORMATION_MODEL": {
-        "app_number": 1621,
-        "app_version": "5.0.1",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz"
-      },
-      "SPLUNK_ES_CONTENT_UPDATE": {
-        "app_number": 3449,
-        "app_version": null,
-        "local_path": null
-      },
-      "SPLUNK_MACHINE_LEARNING_TOOLKIT": {
-        "app_number": 2890,
-        "app_version": "5.3.1",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
-      },
-      "SPLUNK_TA_FOR_ZEEK": {
-        "app_number": 5466,
-        "app_version": "1.0.5",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
-      },
-      "URL_TOOLBOX": {
-        "app_number": 2734,
-        "app_version": "1.9.2",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
-      },
-      "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
-        "app_number": 3088,
-        "app_version": "4.0.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-cloud-platform_400.tgz"
-      },
-      "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
-        "app_number": 3110,
-        "app_version": "2.3.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_230.tgz"
-    },
-    "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
-      "app_number": 2757,
-      "app_version": "8.0.1",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_801.tgz"
-    },
-    "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
-      "app_number": 2882,
-      "app_version": "4.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_410.tgz"
-    },
-    "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
-      "app_number": 3719,
-      "app_version": "1.3.2",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
-    },
-    "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
-      "app_number": 3088,
-      "app_version": "4.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_410.tgz"
-    },
-    "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
-      "app_number": 3110,
-      "app_version": "2.4.1",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_241.tgz"
-    },
-    "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
-      "app_number": 4055,
-      "app_version": "4.2.1",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_421.tgz"
-    },
-    "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
-      "app_number": 742,
-      "app_version": "8.5.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz"
-    },
-    "SPLUNK_ADD_ON_FOR_NGINX": {
-      "app_number": 3258,
-      "app_version": "3.2.1",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_321.tgz"
-    },
-    "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
-      "app_number": 5238,
-      "app_version": "8.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz"
-    },
-    "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
-      "app_number": 5234,
-      "app_version": "8.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz"
-    },
-    "SPLUNK_ADD_ON_FOR_SYSMON": {
-      "app_number": 5709,
-      "app_version": "3.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_310.tgz"
-    },
-    "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
-      "app_number": 833,
-      "app_version": "8.8.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_880.tgz"
-    },
-    "SPLUNK_APP_FOR_STREAM": {
-      "app_number": 1809,
-      "app_version": "8.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz"
-    },
-    "SPLUNK_COMMON_INFORMATION_MODEL": {
-      "app_number": 1621,
-      "app_version": "5.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_510.tgz"
-    },
-    "SPLUNK_ES_CONTENT_UPDATE": {
-      "app_number": 3449,
-      "app_version": null,
-      "local_path": null
-    },
-    "SPLUNK_MACHINE_LEARNING_TOOLKIT": {
-      "app_number": 2890,
-      "app_version": "5.4.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_540.tgz"
-    },
-    "SPLUNK_TA_FIX_WINDOWS": {
-      "app_number": 9999,
-      "app_version": "1.0.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz"
-    },
-    "SPLUNK_TA_FOR_IIS": {
-      "app_number": 3185,
-      "app_version": "1.2.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz"
-    },
-    "SPLUNK_TA_FOR_ZEEK": {
-      "app_number": 5466,
-      "app_version": "1.0.5",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
-    },
-    "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
-      "app_number": 3110,
-      "app_version": "4.5.2",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_452.tgz"
-    },
     "Splunk Add-on for CrowdStrike FDR": {
       "app_number": 5579,
       "app_version": "1.3.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_130.tgz"
-    },
-    "URL_TOOLBOX": {
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_130.tgz",
+  },
+  "ADD_ON_FOR_LINUX_SYSMON": {
+      "app_number": 6176,
+      "app_version": "1.0.4",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz",
+  },
+  "SPLUNK_TA_FIX_WINDOWS": {
+      "app_number": 9999,
+      "app_version": "1.0.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz",
+  },
+  "SPLUNK_TA_FOR_IIS": {
+      "app_number": 3185,
+      "app_version": "1.2.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz",
+  },
+  "SPLUNK_ES_CONTENT_UPDATE": {
+      "app_number": 3449,
+      "app_version": null,
+      "local_path": null,
+  },
+  "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
+      "app_number": 2757,
+      "app_version": "8.0.1",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_801.tgz",
+  },
+  "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
+      "app_number": 2882,
+      "app_version": "4.1.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_410.tgz",
+  },
+  "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
+      "app_number": 3719,
+      "app_version": "1.3.2",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz",
+  },
+  "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
+      "app_number": 4055,
+      "app_version": "4.2.1",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_421.tgz",
+  },
+  "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
+      "app_number": 742,
+      "app_version": "8.5.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz",
+  },
+  "SPLUNK_ADD_ON_FOR_NGINX": {
+      "app_number": 3258,
+      "app_version": "3.2.1",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_321.tgz",
+  },
+  "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
+      "app_number": 5238,
+      "app_version": "8.1.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz",
+  },
+  "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
+      "app_number": 5234,
+      "app_version": "8.1.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz",
+  },
+  "SPLUNK_ADD_ON_FOR_SYSMON": {
+      "app_number": 5709,
+      "app_version": "3.1.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_310.tgz",
+  },
+  "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
+      "app_number": 833,
+      "app_version": "8.8.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_880.tgz",
+  },
+  "SPLUNK_APP_FOR_STREAM": {
+      "app_number": 1809,
+      "app_version": "8.1.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz",
+  },
+  "SPLUNK_MACHINE_LEARNING_TOOLKIT": {
+      "app_number": 2890,
+      "app_version": "5.4.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_540.tgz",
+  },
+  "SPLUNK_TA_FOR_ZEEK": {
+      "app_number": 5466,
+      "app_version": "1.0.5",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz",
+  },
+  "URL_TOOLBOX": {
       "app_number": 2734,
       "app_version": "1.9.2",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
-    }
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz",
+  },
+  "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
+      "app_number": 3110,
+      "app_version": "4.5.2",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_452.tgz",
+  },
+  "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
+      "app_number": 3088,
+      "app_version": "4.1.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_410.tgz",
+  },
+  "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
+      "app_number": 3110,
+      "app_version": "2.4.1",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_241.tgz",
+  },
+  "SPLUNK_TA_FOR_SURICATA": {
+      "app_number": 2760,
+      "app_version": "2.3.3",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-suricata_234.tgz",
+  },
+  "SPLUNK_COMMON_INFORMATION_MODEL": {
+      "app_number": 1621,
+      "app_version": "5.1.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_510.tgz",
+  }
   },
   "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
   "commit_hash": null,

From 4ef47f2fcc0350df51b6fbca1533516db6759ed0 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 15 May 2023 12:56:47 -0700
Subject: [PATCH 03/12] Fix source and sourcetype of attack_data

---
 .../application/papercutng_suspicious_behavior_debug_log.yml  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/application/papercutng_suspicious_behavior_debug_log.yml b/detections/application/papercutng_suspicious_behavior_debug_log.yml
index a8c2e4fabf..5a034ce4f7 100644
--- a/detections/application/papercutng_suspicious_behavior_debug_log.yml
+++ b/detections/application/papercutng_suspicious_behavior_debug_log.yml
@@ -54,5 +54,5 @@ tests:
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/papercut/server.log
-    source: stash
-    sourcetype: stash
+    source: papercutng
+    sourcetype: papercutng

From 4b04df1ff815ac97d7eca4d43dc6e409a918bcd6 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 15 May 2023 13:52:12 -0700
Subject: [PATCH 04/12] Updated all app baselines in validate_args

---
 .../modules/validate_args.py                     | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py
index b4846c693e..234e680252 100644
--- a/bin/docker_detection_tester/modules/validate_args.py
+++ b/bin/docker_detection_tester/modules/validate_args.py
@@ -47,7 +47,7 @@ setup_schema = {
                 "Splunk Add-on for CrowdStrike FDR": {
                     "app_number": 5579,
                     "app_version": "1.3.0",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_130.tgz",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_140.tgz",
                 },
                 "ADD_ON_FOR_LINUX_SYSMON": {
                     "app_number": 6176,
@@ -67,7 +67,7 @@ setup_schema = {
                 "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
                     "app_number": 2757,
                     "app_version": "8.0.1",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_801.tgz",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_802.tgz",
                 },
                 "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
                     "app_number": 2882,
@@ -82,12 +82,12 @@ setup_schema = {
                 "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
                     "app_number": 4055,
                     "app_version": "4.2.1",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_421.tgz",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_430.tgz",
                 },
                 "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
                     "app_number": 742,
                     "app_version": "8.5.0",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_870.tgz",
                 },
                 "SPLUNK_ADD_ON_FOR_NGINX": {
                     "app_number": 3258,
@@ -112,7 +112,7 @@ setup_schema = {
                 "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
                     "app_number": 833,
                     "app_version": "8.8.0",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_880.tgz",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_890.tgz",
                 },
                 "SPLUNK_APP_FOR_STREAM": {
                     "app_number": 1809,
@@ -142,7 +142,7 @@ setup_schema = {
                 "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
                     "app_number": 3110,
                     "app_version": "4.5.2",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_452.tgz",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_510.tgz",
                 },
                 "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
                     "app_number": 3088,
@@ -152,7 +152,7 @@ setup_schema = {
                 "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
                     "app_number": 3110,
                     "app_version": "2.4.1",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_241.tgz",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_251.tgz",
                 },
                 "SPLUNK_TA_FOR_SURICATA": {
                     "app_number": 2760,
@@ -162,7 +162,7 @@ setup_schema = {
                 "SPLUNK_COMMON_INFORMATION_MODEL": {
                     "app_number": 1621,
                     "app_version": "5.1.0",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_510.tgz",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_511.tgz",
                 }
             },
         },

From b24394affd15f1dbaf6705fd9b319d8da1b75bd8 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 15 May 2023 13:54:53 -0700
Subject: [PATCH 05/12] Push a new github_actions test config file

---
 .../test_config_github_actions.json           | 240 +++++++++---------
 1 file changed, 120 insertions(+), 120 deletions(-)

diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json
index b7b05965d7..d940bd389e 100644
--- a/bin/docker_detection_tester/test_config_github_actions.json
+++ b/bin/docker_detection_tester/test_config_github_actions.json
@@ -1,126 +1,126 @@
 {
   "apps": {
+    "ADD_ON_FOR_LINUX_SYSMON": {
+        "app_number": 6176,
+        "app_version": "1.0.4",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
+    },
+    "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
+        "app_number": 2757,
+        "app_version": "8.0.1",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_802.tgz"
+    },
+    "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
+        "app_number": 2882,
+        "app_version": "4.1.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_410.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
+        "app_number": 3719,
+        "app_version": "1.3.2",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
+        "app_number": 3088,
+        "app_version": "4.1.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_410.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
+        "app_number": 3110,
+        "app_version": "2.4.1",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_251.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
+        "app_number": 4055,
+        "app_version": "4.2.1",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_430.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
+        "app_number": 742,
+        "app_version": "8.5.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_870.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_NGINX": {
+        "app_number": 3258,
+        "app_version": "3.2.1",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_321.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
+        "app_number": 5238,
+        "app_version": "8.1.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
+        "app_number": 5234,
+        "app_version": "8.1.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_SYSMON": {
+        "app_number": 5709,
+        "app_version": "3.1.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_310.tgz"
+    },
+    "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
+        "app_number": 833,
+        "app_version": "8.8.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_890.tgz"
+    },
+    "SPLUNK_APP_FOR_STREAM": {
+        "app_number": 1809,
+        "app_version": "8.1.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz"
+    },
+    "SPLUNK_COMMON_INFORMATION_MODEL": {
+        "app_number": 1621,
+        "app_version": "5.1.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_511.tgz"
+    },
+    "SPLUNK_ES_CONTENT_UPDATE": {
+        "app_number": 3449,
+        "app_version": null,
+        "local_path": null
+    },
+    "SPLUNK_MACHINE_LEARNING_TOOLKIT": {
+        "app_number": 2890,
+        "app_version": "5.4.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_540.tgz"
+    },
+    "SPLUNK_TA_FIX_WINDOWS": {
+        "app_number": 9999,
+        "app_version": "1.0.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz"
+    },
+    "SPLUNK_TA_FOR_IIS": {
+        "app_number": 3185,
+        "app_version": "1.2.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz"
+    },
+    "SPLUNK_TA_FOR_SURICATA": {
+        "app_number": 2760,
+        "app_version": "2.3.3",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-suricata_234.tgz"
+    },
+    "SPLUNK_TA_FOR_ZEEK": {
+        "app_number": 5466,
+        "app_version": "1.0.5",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
+    },
+    "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
+        "app_number": 3110,
+        "app_version": "4.5.2",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_510.tgz"
+    },
     "Splunk Add-on for CrowdStrike FDR": {
-      "app_number": 5579,
-      "app_version": "1.3.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_130.tgz",
-  },
-  "ADD_ON_FOR_LINUX_SYSMON": {
-      "app_number": 6176,
-      "app_version": "1.0.4",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz",
-  },
-  "SPLUNK_TA_FIX_WINDOWS": {
-      "app_number": 9999,
-      "app_version": "1.0.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz",
-  },
-  "SPLUNK_TA_FOR_IIS": {
-      "app_number": 3185,
-      "app_version": "1.2.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz",
-  },
-  "SPLUNK_ES_CONTENT_UPDATE": {
-      "app_number": 3449,
-      "app_version": null,
-      "local_path": null,
-  },
-  "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
-      "app_number": 2757,
-      "app_version": "8.0.1",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_801.tgz",
-  },
-  "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
-      "app_number": 2882,
-      "app_version": "4.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_410.tgz",
-  },
-  "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
-      "app_number": 3719,
-      "app_version": "1.3.2",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz",
-  },
-  "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
-      "app_number": 4055,
-      "app_version": "4.2.1",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_421.tgz",
-  },
-  "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
-      "app_number": 742,
-      "app_version": "8.5.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz",
-  },
-  "SPLUNK_ADD_ON_FOR_NGINX": {
-      "app_number": 3258,
-      "app_version": "3.2.1",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_321.tgz",
-  },
-  "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
-      "app_number": 5238,
-      "app_version": "8.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz",
-  },
-  "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
-      "app_number": 5234,
-      "app_version": "8.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz",
-  },
-  "SPLUNK_ADD_ON_FOR_SYSMON": {
-      "app_number": 5709,
-      "app_version": "3.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_310.tgz",
-  },
-  "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
-      "app_number": 833,
-      "app_version": "8.8.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_880.tgz",
-  },
-  "SPLUNK_APP_FOR_STREAM": {
-      "app_number": 1809,
-      "app_version": "8.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz",
-  },
-  "SPLUNK_MACHINE_LEARNING_TOOLKIT": {
-      "app_number": 2890,
-      "app_version": "5.4.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_540.tgz",
-  },
-  "SPLUNK_TA_FOR_ZEEK": {
-      "app_number": 5466,
-      "app_version": "1.0.5",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz",
-  },
-  "URL_TOOLBOX": {
-      "app_number": 2734,
-      "app_version": "1.9.2",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz",
-  },
-  "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
-      "app_number": 3110,
-      "app_version": "4.5.2",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_452.tgz",
-  },
-  "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
-      "app_number": 3088,
-      "app_version": "4.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_410.tgz",
-  },
-  "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
-      "app_number": 3110,
-      "app_version": "2.4.1",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_241.tgz",
-  },
-  "SPLUNK_TA_FOR_SURICATA": {
-      "app_number": 2760,
-      "app_version": "2.3.3",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-suricata_234.tgz",
-  },
-  "SPLUNK_COMMON_INFORMATION_MODEL": {
-      "app_number": 1621,
-      "app_version": "5.1.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_510.tgz",
-  }
-  },
+        "app_number": 5579,
+        "app_version": "1.3.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_140.tgz"
+    },
+    "URL_TOOLBOX": {
+        "app_number": 2734,
+        "app_version": "1.9.2",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
+    }
+},
   "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
   "commit_hash": null,
   "container_tag": "latest",

From f2cb3b89b48113b379d7ee843d6cc1caf4f7334e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 15 May 2023 15:16:34 -0600
Subject: [PATCH 06/12] fixes

---
 detections/endpoint/windows_papercutng_spawn_shell.yml        | 2 +-
 .../application/papercutng_suspicious_behavior_debug_log.yml  | 2 +-
 detections/web/papercutng_remote_web_access_attempt.yml       | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)
 rename detections/{ => experimental}/application/papercutng_suspicious_behavior_debug_log.yml (99%)

diff --git a/detections/endpoint/windows_papercutng_spawn_shell.yml b/detections/endpoint/windows_papercutng_spawn_shell.yml
index 00d816a3f8..8f6673f481 100644
--- a/detections/endpoint/windows_papercutng_spawn_shell.yml
+++ b/detections/endpoint/windows_papercutng_spawn_shell.yml
@@ -9,7 +9,7 @@ data_source:
 - Sysmon Event ID 1
 description: The following analytic is designed to detect instances where the PaperCutNG application (pc-app.exe) spawns a Windows shell, specifically cmd.exe or PowerShell. This behavior may indicate potential malicious activity, such as an attacker attempting to gain unauthorized access or execute harmful commands on the affected system.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=pc-app.exe `process_cmd` OR `process_powershell`
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=pc-app.exe `process_cmd` OR `process_powershell` OR Processes.process_name=java.exe
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_papercutng_spawn_shell_filter`'
diff --git a/detections/application/papercutng_suspicious_behavior_debug_log.yml b/detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml
similarity index 99%
rename from detections/application/papercutng_suspicious_behavior_debug_log.yml
rename to detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml
index 5a034ce4f7..d10866663c 100644
--- a/detections/application/papercutng_suspicious_behavior_debug_log.yml
+++ b/detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml
@@ -3,7 +3,7 @@ id: 395163b8-689b-444b-86c7-9fe9ad624734
 version: 1
 date: '2023-05-15'
 author: Michael Haag, Splunk
-status: production
+status: experimental
 type: Hunting
 data_source: []
 description: The following hunting analytic is designed to monitor and detect potential exploitation attempts targeting a PaperCutNG server by analyzing its debug log data. By focusing on public IP addresses accessing the PaperCutNG instance, this analytic aims to identify unauthorized or suspicious access attempts. Furthermore, it searches for specific URIs that have been discovered in the proof of concept code, which are associated with known exploits or vulnerabilities. The analytic is focused on the user admin. Regex is used mainly because the log is not parsed by Splunk and there is no TA for this debug log.
diff --git a/detections/web/papercutng_remote_web_access_attempt.yml b/detections/web/papercutng_remote_web_access_attempt.yml
index 3fa6640e2e..90c30e5d5d 100644
--- a/detections/web/papercutng_remote_web_access_attempt.yml
+++ b/detections/web/papercutng_remote_web_access_attempt.yml
@@ -53,5 +53,5 @@ tests:
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/papercut/papercutng-suricata.log
-    source: stash
-    sourcetype: stash
+    source: suricata
+    sourcetype: suricata

From 7b27c93bad48b596a7ee751b44126ec383f7fe7a Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 15 May 2023 15:11:32 -0700
Subject: [PATCH 07/12] story renames

---
 detections/endpoint/windows_papercutng_spawn_shell.yml        | 2 +-
 .../application/papercutng_suspicious_behavior_debug_log.yml  | 2 +-
 detections/web/papercutng_remote_web_access_attempt.yml       | 2 +-
 stories/papercut mf_ng_vulnerability.yml                      | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/windows_papercutng_spawn_shell.yml b/detections/endpoint/windows_papercutng_spawn_shell.yml
index 8f6673f481..aa4beb6f69 100644
--- a/detections/endpoint/windows_papercutng_spawn_shell.yml
+++ b/detections/endpoint/windows_papercutng_spawn_shell.yml
@@ -20,7 +20,7 @@ references:
   - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
 tags:
   analytic_story:
-  - PaperCutNG MF NG Vulnerability
+  - PaperCut MF NG Vulnerability
   asset_type: Endpoint
   atomic_guid: []
   confidence: 90
diff --git a/detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml b/detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml
index d10866663c..52fe096687 100644
--- a/detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml
+++ b/detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml
@@ -25,7 +25,7 @@ references:
   - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
 tags:
   analytic_story:
-  - PaperCutNG MF NG Vulnerability
+  - PaperCut MF NG Vulnerability
   asset_type: Web Server
   atomic_guid: []
   confidence: 80
diff --git a/detections/web/papercutng_remote_web_access_attempt.yml b/detections/web/papercutng_remote_web_access_attempt.yml
index 90c30e5d5d..9cf0dad22c 100644
--- a/detections/web/papercutng_remote_web_access_attempt.yml
+++ b/detections/web/papercutng_remote_web_access_attempt.yml
@@ -21,7 +21,7 @@ references:
   - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
 tags:
   analytic_story:
-  - PaperCutNG MF NG Vulnerability
+  - PaperCut MF NG Vulnerability
   asset_type: Web Server
   atomic_guid: []
   confidence: 70
diff --git a/stories/papercut mf_ng_vulnerability.yml b/stories/papercut mf_ng_vulnerability.yml
index e12771809f..3929954a77 100644
--- a/stories/papercut mf_ng_vulnerability.yml	
+++ b/stories/papercut mf_ng_vulnerability.yml	
@@ -1,4 +1,4 @@
-name: PaperCutNG MF NG Vulnerability
+name: PaperCut MF NG Vulnerability
 id: 2493d270-5665-4fb4-99c7-8f886f260676
 version: 1
 date: '2023-05-15'
@@ -19,7 +19,7 @@ references:
   - https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/
   - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
 tags:
-  analytic_story: PaperCutNG MF NG Vulnerability
+  analytic_story: PaperCut MF NG Vulnerability
   cve: 
   - CVE-2023-27350
   - CVE-2023-27351

From 07be57790bfe5284b5b49ce3301b33a7b675e5d7 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 16 May 2023 09:08:35 -0600
Subject: [PATCH 08/12] Update and rename windows_papercutng_spawn_shell.yml to
 windows_papercut_ng_spawn_shell.yml

---
 ...ng_spawn_shell.yml => windows_papercut_ng_spawn_shell.yml} | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename detections/endpoint/{windows_papercutng_spawn_shell.yml => windows_papercut_ng_spawn_shell.yml} (97%)

diff --git a/detections/endpoint/windows_papercutng_spawn_shell.yml b/detections/endpoint/windows_papercut_ng_spawn_shell.yml
similarity index 97%
rename from detections/endpoint/windows_papercutng_spawn_shell.yml
rename to detections/endpoint/windows_papercut_ng_spawn_shell.yml
index aa4beb6f69..ac2f5a35a9 100644
--- a/detections/endpoint/windows_papercutng_spawn_shell.yml
+++ b/detections/endpoint/windows_papercut_ng_spawn_shell.yml
@@ -1,4 +1,4 @@
-name: Windows PaperCutNG Spawn Shell
+name: Windows PaperCut NG Spawn Shell
 id: a602d9a2-aaea-45f8-bf0f-d851168d61ca
 version: 1
 date: '2023-05-15'
@@ -12,7 +12,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=pc-app.exe `process_cmd` OR `process_powershell` OR Processes.process_name=java.exe
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_papercutng_spawn_shell_filter`'
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_papercut_ng_spawn_shell_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present, but most likely not. Filter as needed.
 references:

From 08fc8920172dc071c7320d5d82fccfa0260d63dd Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 16 May 2023 09:10:59 -0600
Subject: [PATCH 09/12] name fixes

---
 .../endpoint/windows_papercut_ng_spawn_shell.yml       |  4 ++--
 .../papercutng_suspicious_behavior_debug_log.yml       | 10 +++++-----
 .../web/papercutng_remote_web_access_attempt.yml       | 10 +++++-----
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/windows_papercut_ng_spawn_shell.yml b/detections/endpoint/windows_papercut_ng_spawn_shell.yml
index ac2f5a35a9..3687655fd0 100644
--- a/detections/endpoint/windows_papercut_ng_spawn_shell.yml
+++ b/detections/endpoint/windows_papercut_ng_spawn_shell.yml
@@ -7,7 +7,7 @@ status: production
 type: TTP
 data_source:
 - Sysmon Event ID 1
-description: The following analytic is designed to detect instances where the PaperCutNG application (pc-app.exe) spawns a Windows shell, specifically cmd.exe or PowerShell. This behavior may indicate potential malicious activity, such as an attacker attempting to gain unauthorized access or execute harmful commands on the affected system.
+description: The following analytic is designed to detect instances where the PaperCut NG application (pc-app.exe) spawns a Windows shell, specifically cmd.exe or PowerShell. This behavior may indicate potential malicious activity, such as an attacker attempting to gain unauthorized access or execute harmful commands on the affected system.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=pc-app.exe `process_cmd` OR `process_powershell` OR Processes.process_name=java.exe
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
@@ -25,7 +25,7 @@ tags:
   atomic_guid: []
   confidence: 90
   impact: 100
-  message: The PaperCutNG application has spawned a shell $process_name$ on endpoint $dest$ by $user$.
+  message: The PaperCut NG application has spawned a shell $process_name$ on endpoint $dest$ by $user$.
   mitre_attack_id:
   - T1059
   - T1190
diff --git a/detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml b/detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml
index 52fe096687..cce66a6674 100644
--- a/detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml
+++ b/detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml
@@ -1,4 +1,4 @@
-name: PaperCutNG Suspicious Behavior Debug Log
+name: PaperCut NG Suspicious Behavior Debug Log
 id: 395163b8-689b-444b-86c7-9fe9ad624734
 version: 1
 date: '2023-05-15'
@@ -6,15 +6,15 @@ author: Michael Haag, Splunk
 status: experimental
 type: Hunting
 data_source: []
-description: The following hunting analytic is designed to monitor and detect potential exploitation attempts targeting a PaperCutNG server by analyzing its debug log data. By focusing on public IP addresses accessing the PaperCutNG instance, this analytic aims to identify unauthorized or suspicious access attempts. Furthermore, it searches for specific URIs that have been discovered in the proof of concept code, which are associated with known exploits or vulnerabilities. The analytic is focused on the user admin. Regex is used mainly because the log is not parsed by Splunk and there is no TA for this debug log.
+description: The following hunting analytic is designed to monitor and detect potential exploitation attempts targeting a PaperCut NG server by analyzing its debug log data. By focusing on public IP addresses accessing the PaperCut NG instance, this analytic aims to identify unauthorized or suspicious access attempts. Furthermore, it searches for specific URIs that have been discovered in the proof of concept code, which are associated with known exploits or vulnerabilities. The analytic is focused on the user admin. Regex is used mainly because the log is not parsed by Splunk and there is no TA for this debug log.
 search: '`papercutng` (loginType=Admin OR userName=admin) 
   | eval uri_match=if(match(_raw, "(?i)(\/app\?service=page\/SetupCompleted|\/app|\/app\?service=page\/PrinterList|\/app\?service=direct\/1\/PrinterList\/selectPrinter&sp=l1001|\/app\?service=direct\/1\/PrinterDetails\/printerOptionsTab\.tab)"), "URI matches", null())
   | eval ip_match=if(match(_raw, "(?i)((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))") AND NOT match(_raw, "(?i)(10\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|(172\.(1[6-9]|2[0-9]|3[0-1])\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|(192\.168\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))"), "IP matches", null())
   | where  (isnotnull(uri_match) OR isnotnull(ip_match))
   | stats sparkline, count, values(uri_match) AS uri_match, values(ip_match) AS ip_match latest(_raw)
-    BY host, index, sourcetype | `papercutng_suspicious_behavior_debug_log_filter`'
+    BY host, index, sourcetype | `papercut_ng_suspicious_behavior_debug_log_filter`'
 how_to_implement: Debug logs must be enabled and shipped to Splunk in order to properly identify behavior with this analytic.
-known_false_positives: False positives may be present, as this is based on the admin user accessing the PapercutNG instance from a public IP address. Filter as needed.
+known_false_positives: False positives may be present, as this is based on the admin user accessing the Papercut NG instance from a public IP address. Filter as needed.
 references:
   - https://www.papercut.com/kb/Main/HowToCollectApplicationServerDebugLogs
   - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/HAFNIUM.md
@@ -30,7 +30,7 @@ tags:
   atomic_guid: []
   confidence: 80
   impact: 80
-  message: Behavior related to exploitation of PaperCutNG has been identified on $host$.
+  message: Behavior related to exploitation of PaperCut NG has been identified on $host$.
   mitre_attack_id:
   - T1190
   observable:
diff --git a/detections/web/papercutng_remote_web_access_attempt.yml b/detections/web/papercutng_remote_web_access_attempt.yml
index 9cf0dad22c..5f46d9b535 100644
--- a/detections/web/papercutng_remote_web_access_attempt.yml
+++ b/detections/web/papercutng_remote_web_access_attempt.yml
@@ -1,4 +1,4 @@
-name: PaperCutNG Remote Web Access Attempt
+name: PaperCut NG Remote Web Access Attempt
 id: 9fcb214a-dc42-4ce7-a650-f1d2cab16a6a
 version: 1
 date: '2023-05-15'
@@ -6,10 +6,10 @@ author: Michael Haag, Splunk
 status: production
 type: TTP
 data_source: []
-description: The following analytic is designed to detect potential exploitation attempts on publicly accessible PaperCutNG servers. It identifies connections from public IP addresses to the server and specifically monitors for URI paths commonly found in proof-of-concept (POC) scripts for exploiting PaperCutNG vulnerabilities. These URI paths have been observed in both Metasploit modules and standalone scripts used for attacking PaperCutNG servers.
-  When a public IP address is detected accessing one or more of these suspicious URI paths, an alert may be generated to notify the security team of the potential threat. The team can then investigate the source IP address, the targeted PaperCutNG server, and any other relevant information to determine the nature of the activity and take appropriate actions to mitigate the risk.
+description: The following analytic is designed to detect potential exploitation attempts on publicly accessible PaperCut NG servers. It identifies connections from public IP addresses to the server and specifically monitors for URI paths commonly found in proof-of-concept (POC) scripts for exploiting PaperCut NG vulnerabilities. These URI paths have been observed in both Metasploit modules and standalone scripts used for attacking PaperCut NG servers.
+  When a public IP address is detected accessing one or more of these suspicious URI paths, an alert may be generated to notify the security team of the potential threat. The team can then investigate the source IP address, the targeted PaperCut NG server, and any other relevant information to determine the nature of the activity and take appropriate actions to mitigate the risk.
 search: '| tstats count from datamodel=Web where Web.url IN ("/app?service=page/SetupCompleted", "/app", "/app?service=page/PrinterList", "/app?service=direct/1/PrinterList/selectPrinter&sp=*", "/app?service=direct/1/PrinterDetails/printerOptionsTab.tab") NOT (src IN ("10.*.*.*","172.16.*.*", "192.168.*.*", "169.254.*.*", "127.*.*.*", "fc00::*", "fd00::*", "fe80::*")) by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest Web.dest_port sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `papercutng_remote_web_access_attempt_filter`'
+  | `security_content_ctime(lastTime)` | `papercut_ng_remote_web_access_attempt_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on Web traffic that include fields relavent for traffic into the `Web` datamodel.
 known_false_positives: False positives may be present, filter as needed.
@@ -26,7 +26,7 @@ tags:
   atomic_guid: []
   confidence: 70
   impact: 90
-  message: URIs specific to PaperCutNG have been access by a public IP against $dest$.
+  message: URIs specific to PaperCut NG have been access by a public IP against $dest$.
   mitre_attack_id:
   - T1190
   observable:

From 0f0002b9cf987ae187955fa0d671d8f514d3bcad Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 16 May 2023 09:11:38 -0600
Subject: [PATCH 10/12] Rename papercutng_remote_web_access_attempt.yml to
 papercut_ng_remote_web_access_attempt.yml

---
 ...cess_attempt.yml => papercut_ng_remote_web_access_attempt.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename detections/web/{papercutng_remote_web_access_attempt.yml => papercut_ng_remote_web_access_attempt.yml} (100%)

diff --git a/detections/web/papercutng_remote_web_access_attempt.yml b/detections/web/papercut_ng_remote_web_access_attempt.yml
similarity index 100%
rename from detections/web/papercutng_remote_web_access_attempt.yml
rename to detections/web/papercut_ng_remote_web_access_attempt.yml

From c17d09140a7d5810238ffece9b3641edc6d479e2 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 16 May 2023 09:12:01 -0600
Subject: [PATCH 11/12] Rename papercutng_suspicious_behavior_debug_log.yml to
 papercut_ng_suspicious_behavior_debug_log.yml

---
 ...ebug_log.yml => papercut_ng_suspicious_behavior_debug_log.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename detections/experimental/application/{papercutng_suspicious_behavior_debug_log.yml => papercut_ng_suspicious_behavior_debug_log.yml} (100%)

diff --git a/detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml b/detections/experimental/application/papercut_ng_suspicious_behavior_debug_log.yml
similarity index 100%
rename from detections/experimental/application/papercutng_suspicious_behavior_debug_log.yml
rename to detections/experimental/application/papercut_ng_suspicious_behavior_debug_log.yml

From 49680f9e51bb354cc810b9f58d1fa7ab28a1f3c6 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 16 May 2023 09:09:57 -0700
Subject: [PATCH 12/12] underscore

---
 ...t mf_ng_vulnerability.yml => papercut_mf_ng_vulnerability.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename stories/{papercut mf_ng_vulnerability.yml => papercut_mf_ng_vulnerability.yml} (100%)

diff --git a/stories/papercut mf_ng_vulnerability.yml b/stories/papercut_mf_ng_vulnerability.yml
similarity index 100%
rename from stories/papercut mf_ng_vulnerability.yml
rename to stories/papercut_mf_ng_vulnerability.yml