From 606876a98fde33382c94ad8bcca62e282aee467f Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 9 Jun 2021 14:26:05 -0600
Subject: [PATCH 01/34] PowerShell Script Block Initial Analytics

---
 ...e_with_powershell_script_block_logging.yml | 48 +++++++++++++++++
 ...z_with_powershell_script_block_logging.yml | 47 +++++++++++++++++
 ...ess_process_injection_(getprocaddress).yml | 50 ++++++++++++++++++
 ...script_contains_base64_encoded_content.yml | 51 +++++++++++++++++++
 .../unloading_amsi_via_reflection.yml         | 47 +++++++++++++++++
 ...h_powershell_script_block_logging.test.yml | 12 +++++
 ...h_powershell_script_block_logging.test.yml | 12 +++++
 ...rocess_injection_(getprocaddress).test.yml | 12 +++++
 ...t_contains_base64_encoded_content.test.yml | 12 +++++
 .../unloading_amsi_via_reflection.test.yml    | 12 +++++
 10 files changed, 303 insertions(+)
 create mode 100644 detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
 create mode 100644 detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
 create mode 100644 detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml
 create mode 100644 detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
 create mode 100644 detections/endpoint/unloading_amsi_via_reflection.yml
 create mode 100644 tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml
 create mode 100644 tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
 create mode 100644 tests/endpoint/powershell_fileless_process_injection_(getprocaddress).test.yml
 create mode 100644 tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml
 create mode 100644 tests/endpoint/unloading_amsi_via_reflection.test.yml

diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
new file mode 100644
index 0000000000..efcc6b01db
--- /dev/null
+++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
@@ -0,0 +1,48 @@
+name: Detect Empire with PowerShell Script Block Logging
+id: bc1dc6b8-c954-11eb-bade-acde48001122
+version: 1
+date: '2021-06-09'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 
+  | eval empire=if(match(lower(Message),"system.net.webclient") AND  match(lower(Message), "frombase64string") ,1,0)
+  | addtotals fieldname=Score empire
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by empire OpCode ComputerName User EventCode Message
+  | where empire = 1
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `detect_empire_with_powershell_script_block_logging_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern.
+references:
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+  - https://github.com/BC-SECURITY/Empire
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
new file mode 100644
index 0000000000..eb44a9de9c
--- /dev/null
+++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
@@ -0,0 +1,47 @@
+name: Detect Mimikatz With PowerShell Script Block Logging
+id: 8148c29c-c952-11eb-9255-acde48001122
+version: 1
+date: '2021-06-09'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 
+  | eval mimikatz=if(match(lower(Message),"mimikatz") OR match(lower(Message), "-dumpcr") OR match(lower(Message), "sekurlsa::pth") OR match(lower(Message), "kerberos::ptt") OR match(lower(Message), "kerberos::golden") ,1,0)
+  | addtotals fieldname=Score mimikatz
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by mimikatz OpCode ComputerName User EventCode Message
+  | where mimikatz = 1
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `detect_mimikatz_with_powershell_script_block_logging_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
+references:
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml b/detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml
new file mode 100644
index 0000000000..6d6316cbd9
--- /dev/null
+++ b/detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml
@@ -0,0 +1,50 @@
+name: Powershell Fileless Process Injection (GetProcAddress)
+id: a26d9db4-c883-11eb-9d75-acde48001122
+version: 1
+date: '2021-06-08'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies `GetProcAddress` in the script block. This is not normal to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack toolkits use GetProcAddress to obtain code execution. \
+
+  In use, `$var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'))` and later referenced/executed elsewhere. \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 
+  | eval getproc=if(match(lower(Message),"getprocaddress"),1,0) 
+  | addtotals fieldname=Score getproc
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by getproc OpCode ComputerName User EventCode Message
+  | where getproc = 1
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `powershell_fileless_process_injection_(getprocaddress)_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Limited false positives. Filter as needed.
+references:
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
new file mode 100644
index 0000000000..934b309916
--- /dev/null
+++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -0,0 +1,51 @@
+name: Powershell Fileless Script Contains Base64 Encoded Content
+id: 8acbc04c-c882-11eb-b060-acde48001122
+version: 1
+date: '2021-06-08'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \
+
+  Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String('38uqIyMjQ6rG....` \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 
+  | eval Encode=if(match(lower(Message),"frombase64string"),1,0) 
+  | addtotals fieldname=Score Encode
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by Encode OpCode ComputerName User EventCode Message
+  | where Encode = 1
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `powershell_fileless_script_contains_base64_encoded_content_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives should be limited. Filter as needed.
+references:
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1027
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml
new file mode 100644
index 0000000000..7567c66c33
--- /dev/null
+++ b/detections/endpoint/unloading_amsi_via_reflection.yml
@@ -0,0 +1,47 @@
+name: Unloading AMSI via Reflection
+id: a21e3484-c94d-11eb-b55b-acde48001122
+version: 1
+date: '2021-06-09'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe('System.Management.Automation.Amsi'+'Utils')` taken from Powershell-Empire. \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 
+  | eval amsi=if(match(lower(Message),"system.management.automation.amsi"),1,0) 
+  | addtotals fieldname=Score amsi
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by amsi OpCode ComputerName User EventCode Message
+  | where amsi = 1
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `unloading_amsi_via_reflection_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Potential for some third party applications to disable AMSI upon invocation. Filter as needed.
+references:
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml b/tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml
new file mode 100644
index 0000000000..9f6c847c9b
--- /dev/null
+++ b/tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml
@@ -0,0 +1,12 @@
+name: Detect Empire with PowerShell Script Block Logging Unit Test
+tests:
+- name: Detect Empire with PowerShell Script Block Logging
+  file: endpoint/detect_empire_with_powershell_script_block_logging.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
new file mode 100644
index 0000000000..f03fd4d85e
--- /dev/null
+++ b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
@@ -0,0 +1,12 @@
+name: Detect Mimikatz With PowerShell Script Block Logging Unit Test
+tests:
+- name: Detect Mimikatz With PowerShell Script Block Logging
+  file: endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/powershell_fileless_process_injection_(getprocaddress).test.yml b/tests/endpoint/powershell_fileless_process_injection_(getprocaddress).test.yml
new file mode 100644
index 0000000000..cd224b6db1
--- /dev/null
+++ b/tests/endpoint/powershell_fileless_process_injection_(getprocaddress).test.yml
@@ -0,0 +1,12 @@
+name: Powershell Fileless Process Injection (GetProcAddress) Unit Test
+tests:
+- name: Powershell Fileless Process Injection (GetProcAddress)
+  file: endpoint/powershell_fileless_process_injection_(getprocaddress).yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml b/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml
new file mode 100644
index 0000000000..a407149eda
--- /dev/null
+++ b/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml
@@ -0,0 +1,12 @@
+name: Powershell Fileless Script Contains Base64 Encoded Content Unit Test
+tests:
+- name: Powershell Fileless Script Contains Base64 Encoded Content
+  file: endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/unloading_amsi_via_reflection.test.yml b/tests/endpoint/unloading_amsi_via_reflection.test.yml
new file mode 100644
index 0000000000..60b06d3cd8
--- /dev/null
+++ b/tests/endpoint/unloading_amsi_via_reflection.test.yml
@@ -0,0 +1,12 @@
+name: Unloading AMSI via Reflection Unit Test
+tests:
+- name: Unloading AMSI via Reflection
+  file: endpoint/unloading_amsi_via_reflection.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
\ No newline at end of file

From 5cfee7b0b4570a6d86c61526a1d2d8be7a106630 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 9 Jun 2021 14:33:20 -0600
Subject: [PATCH 02/34] format errors

---
 .../powershell_fileless_process_injection_(getprocaddress).yml  | 2 +-
 ...wershell_fileless_script_contains_base64_encoded_content.yml | 2 +-
 detections/endpoint/unloading_amsi_via_reflection.yml           | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml b/detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml
index 6d6316cbd9..bce1460826 100644
--- a/detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml
+++ b/detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml
@@ -9,7 +9,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
 
   This analytic identifies `GetProcAddress` in the script block. This is not normal to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack toolkits use GetProcAddress to obtain code execution. \
 
-  In use, `$var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'))` and later referenced/executed elsewhere. \
+  In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later referenced/executed elsewhere. \
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 
diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
index 934b309916..c3ed00b9ea 100644
--- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -9,7 +9,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
 
   This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \
 
-  Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String('38uqIyMjQ6rG....` \
+  Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 
diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml
index 7567c66c33..aa5188094f 100644
--- a/detections/endpoint/unloading_amsi_via_reflection.yml
+++ b/detections/endpoint/unloading_amsi_via_reflection.yml
@@ -7,7 +7,7 @@ type: batch
 datamodel: []
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
 
-  This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe('System.Management.Automation.Amsi'+'Utils')` taken from Powershell-Empire. \
+  This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 

From d8e3e4c2f70a13e8f86b500dd77bb49f0f9471c5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 9 Jun 2021 14:36:18 -0600
Subject: [PATCH 03/34] special char remove

---
 ... powershell_fileless_process_injection___getprocaddress.yml} | 2 +-
 ...rshell_fileless_process_injection___getprocaddress.test.yml} | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename detections/endpoint/{powershell_fileless_process_injection_(getprocaddress).yml => powershell_fileless_process_injection___getprocaddress.yml} (97%)
 rename tests/endpoint/{powershell_fileless_process_injection_(getprocaddress).test.yml => powershell_fileless_process_injection___getprocaddress.test.yml} (87%)

diff --git a/detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml b/detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml
similarity index 97%
rename from detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml
rename to detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml
index bce1460826..96485a65f1 100644
--- a/detections/endpoint/powershell_fileless_process_injection_(getprocaddress).yml
+++ b/detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml
@@ -1,4 +1,4 @@
-name: Powershell Fileless Process Injection (GetProcAddress)
+name: Powershell Fileless Process Injection - GetProcAddress
 id: a26d9db4-c883-11eb-9d75-acde48001122
 version: 1
 date: '2021-06-08'
diff --git a/tests/endpoint/powershell_fileless_process_injection_(getprocaddress).test.yml b/tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml
similarity index 87%
rename from tests/endpoint/powershell_fileless_process_injection_(getprocaddress).test.yml
rename to tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml
index cd224b6db1..38abd78fd1 100644
--- a/tests/endpoint/powershell_fileless_process_injection_(getprocaddress).test.yml
+++ b/tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml
@@ -1,7 +1,7 @@
 name: Powershell Fileless Process Injection (GetProcAddress) Unit Test
 tests:
 - name: Powershell Fileless Process Injection (GetProcAddress)
-  file: endpoint/powershell_fileless_process_injection_(getprocaddress).yml
+  file: endpoint/powershell_fileless_process_injection___getprocaddress.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From f78ddd677756059c8a504a5ba76b23aebe288480 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 9 Jun 2021 14:41:09 -0600
Subject: [PATCH 04/34] formatting

---
 ...shell_fileless_process_injection_via_getprocaddress.yml} | 4 ++--
 ..._fileless_process_injection_via_getprocaddress.test.yml} | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)
 rename detections/endpoint/{powershell_fileless_process_injection___getprocaddress.yml => powershell_fileless_process_injection_via_getprocaddress.yml} (95%)
 rename tests/endpoint/{powershell_fileless_process_injection___getprocaddress.test.yml => powershell_fileless_process_injection_via_getprocaddress.test.yml} (65%)

diff --git a/detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
similarity index 95%
rename from detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml
rename to detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
index 96485a65f1..9f725d5cd5 100644
--- a/detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml
+++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
@@ -1,4 +1,4 @@
-name: Powershell Fileless Process Injection - GetProcAddress
+name: Powershell Fileless Process Injection via GetProcAddress
 id: a26d9db4-c883-11eb-9d75-acde48001122
 version: 1
 date: '2021-06-08'
@@ -19,7 +19,7 @@ search: '`powershell` EventCode=4104
   | where getproc = 1
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
-  | `powershell_fileless_process_injection_(getprocaddress)_filter`'
+  | `powershell_fileless_process_injection_via_getprocaddress_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: Limited false positives. Filter as needed.
 references:
diff --git a/tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
similarity index 65%
rename from tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml
rename to tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
index 38abd78fd1..4622c2090a 100644
--- a/tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml
+++ b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
@@ -1,7 +1,7 @@
-name: Powershell Fileless Process Injection (GetProcAddress) Unit Test
+name: Powershell Fileless Process Injection via GetProcAddress Unit Test
 tests:
-- name: Powershell Fileless Process Injection (GetProcAddress)
-  file: endpoint/powershell_fileless_process_injection___getprocaddress.yml
+- name: Powershell Fileless Process Injection via GetProcAddress
+  file: endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From f57f0f22d685c09c203e4a32d0392b2f073f876e Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Jun 2021 11:29:24 -0600
Subject: [PATCH 05/34] Fixed queries

---
 .../detect_empire_with_powershell_script_block_logging.yml | 7 ++-----
 ...etect_mimikatz_with_powershell_script_block_logging.yml | 7 ++-----
 ...shell_fileless_process_injection_via_getprocaddress.yml | 7 ++-----
 ...ell_fileless_script_contains_base64_encoded_content.yml | 7 ++-----
 detections/endpoint/unloading_amsi_via_reflection.yml      | 7 ++-----
 5 files changed, 10 insertions(+), 25 deletions(-)

diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
index efcc6b01db..c23a5bbf6e 100644
--- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
@@ -10,11 +10,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 
-  | eval empire=if(match(lower(Message),"system.net.webclient") AND  match(lower(Message), "frombase64string") ,1,0)
-  | addtotals fieldname=Score empire
-  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by empire OpCode ComputerName User EventCode Message
-  | where empire = 1
+search: '`powershell` EventCode=4104  (Message=*system.net.webclient* AND Message=*frombase64string*)
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `detect_empire_with_powershell_script_block_logging_filter`'
diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
index eb44a9de9c..e888bd55a5 100644
--- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
@@ -10,11 +10,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 
-  | eval mimikatz=if(match(lower(Message),"mimikatz") OR match(lower(Message), "-dumpcr") OR match(lower(Message), "sekurlsa::pth") OR match(lower(Message), "kerberos::ptt") OR match(lower(Message), "kerberos::golden") ,1,0)
-  | addtotals fieldname=Score mimikatz
-  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by mimikatz OpCode ComputerName User EventCode Message
-  | where mimikatz = 1
+search: '`powershell` EventCode=4104 Message IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, *kerberos::ptt*, *kerberos::golden*)
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `detect_mimikatz_with_powershell_script_block_logging_filter`'
diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
index 9f725d5cd5..5827ae1d7a 100644
--- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
+++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
@@ -12,11 +12,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later referenced/executed elsewhere. \
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 
-  | eval getproc=if(match(lower(Message),"getprocaddress"),1,0) 
-  | addtotals fieldname=Score getproc
-  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by getproc OpCode ComputerName User EventCode Message
-  | where getproc = 1
+search: '`powershell` EventCode=4104 Message=*getprocaddress*
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `powershell_fileless_process_injection_via_getprocaddress_filter`'
diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
index c3ed00b9ea..b7806a8f0e 100644
--- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -12,11 +12,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 
-  | eval Encode=if(match(lower(Message),"frombase64string"),1,0) 
-  | addtotals fieldname=Score Encode
-  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by Encode OpCode ComputerName User EventCode Message
-  | where Encode = 1
+search: '`powershell` EventCode=4104 Message=*frombase64string*
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `powershell_fileless_script_contains_base64_encoded_content_filter`'
diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml
index aa5188094f..2c7f09a16f 100644
--- a/detections/endpoint/unloading_amsi_via_reflection.yml
+++ b/detections/endpoint/unloading_amsi_via_reflection.yml
@@ -10,11 +10,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 
-  | eval amsi=if(match(lower(Message),"system.management.automation.amsi"),1,0) 
-  | addtotals fieldname=Score amsi
-  | stats count min(_time) as firstTime max(_time) as lastTime values(Score) by amsi OpCode ComputerName User EventCode Message
-  | where amsi = 1
+search: '`powershell` EventCode=4104 Message=*system.management.automation.amsi*
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `unloading_amsi_via_reflection_filter`'

From 112dddf43c7c0ecf3e296a3507f7f68622631e50 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-13-108>
Date: Tue, 15 Jun 2021 17:53:06 +0000
Subject: [PATCH 06/34] Added detection testing service results inDetect Empire
 with PowerShell Script Block Logging

---
 ...e_with_powershell_script_block_logging.yml | 44 ++++++++++++-------
 1 file changed, 29 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
index c23a5bbf6e..3b867b780c 100644
--- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
@@ -5,28 +5,41 @@ date: '2021-06-09'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify suspicious PowerShell execution. Script Block Logging captures the command
+  sent to PowerShell, the full command to be executed. Upon enabling, logs will output
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
+  \
 
-  This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \
+  This analytic identifies the common PowerShell stager used by PowerShell-Empire.
+  Each stager that may use PowerShell all uses the same pattern. The initial HTTP
+  will be base64 encoded and use `system.net.webclient`. Note that some obfuscation
+  may evade the analytic. \
 
-  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+  During triage, review parallel processes using an EDR product or 4688 events. It
+  will be important to understand the timeline of events around this activity. Review
+  the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104  (Message=*system.net.webclient* AND Message=*frombase64string*)
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
+  User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_empire_with_powershell_script_block_logging_filter`'
-how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern.
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives may only pertain to it not being related to
+  Empire, but another framework. Filter as needed if any applications use the same
+  pattern.
 references:
-  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
-  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
-  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
-  - https://github.com/BC-SECURITY/Empire
+- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://github.com/BC-SECURITY/Empire
 tags:
   analytic_story:
   - Malicious PowerShell
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -42,4 +55,5 @@ tags:
   - ComputerName
   - User
   - EventCode
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From dc8fef0ae2609f2bb4e098950b22136c261db88e Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-130-86>
Date: Tue, 15 Jun 2021 17:59:41 +0000
Subject: [PATCH 07/34] Added detection testing service results inDetect
 Mimikatz With PowerShell Script Block Logging

---
 ...z_with_powershell_script_block_logging.yml | 44 ++++++++++++-------
 1 file changed, 28 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
index e888bd55a5..8b2e4686f3 100644
--- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
@@ -5,27 +5,38 @@ date: '2021-06-09'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify suspicious PowerShell execution. Script Block Logging captures the command
+  sent to PowerShell, the full command to be executed. Upon enabling, logs will output
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
+  \
 
-  This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \
+  This analytic identifies common Mimikatz functions that may be identified in the
+  script block, including `mimikatz`. This will catch the most basic use cases for
+  Pass the Ticket, Pass the Hash and `-DumprCreds`. \
 
-  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, *kerberos::ptt*, *kerberos::golden*)
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `detect_mimikatz_with_powershell_script_block_logging_filter`'
-how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
+  During triage, review parallel processes using an EDR product or 4688 events. It
+  will be important to understand the timeline of events around this activity. Review
+  the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 Message IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*,
+  *kerberos::ptt*, *kerberos::golden*) | stats count min(_time) as firstTime max(_time)
+  as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_mimikatz_with_powershell_script_block_logging_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives should be limited as the commands being identifies
+  are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
 references:
-  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
-  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
-  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
   - Malicious PowerShell
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -41,4 +52,5 @@ tags:
   - ComputerName
   - User
   - EventCode
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From ea30e047cfc987009821815dabb4ada6fc324359 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-117-44>
Date: Tue, 15 Jun 2021 17:59:59 +0000
Subject: [PATCH 08/34] Added detection testing service results inUnloading
 AMSI via Reflection

---
 .../unloading_amsi_via_reflection.yml         | 43 ++++++++++++-------
 1 file changed, 28 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml
index 2c7f09a16f..521e54b285 100644
--- a/detections/endpoint/unloading_amsi_via_reflection.yml
+++ b/detections/endpoint/unloading_amsi_via_reflection.yml
@@ -5,27 +5,39 @@ date: '2021-06-09'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify suspicious PowerShell execution. Script Block Logging captures the command
+  sent to PowerShell, the full command to be executed. Upon enabling, logs will output
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
+  \
 
-  This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \
+  This analytic identifies the behavior of AMSI being tampered with. Implemented natively
+  in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct
+  COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")`
+  taken from Powershell-Empire. \
 
-  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message=*system.management.automation.amsi*
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+  During triage, review parallel processes using an EDR product or 4688 events. It
+  will be important to understand the timeline of events around this activity. Review
+  the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 Message=*system.management.automation.amsi* |
+  stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
+  User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `unloading_amsi_via_reflection_filter`'
-how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Potential for some third party applications to disable AMSI upon invocation. Filter as needed.
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Potential for some third party applications to disable AMSI
+  upon invocation. Filter as needed.
 references:
-  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
-  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
-  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
   - Malicious PowerShell
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -41,4 +53,5 @@ tags:
   - ComputerName
   - User
   - EventCode
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From c9ee862dfb56f7ff3e2eda9cf344b7e5c7bffb11 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-130-86>
Date: Tue, 15 Jun 2021 18:00:40 +0000
Subject: [PATCH 09/34] Added detection testing service results inPowershell
 Fileless Process Injection via GetProcAddress

---
 ...s_process_injection_via_getprocaddress.yml | 43 ++++++++++++-------
 1 file changed, 27 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
index 5827ae1d7a..e34f44a545 100644
--- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
+++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
@@ -5,29 +5,39 @@ date: '2021-06-08'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify suspicious PowerShell execution. Script Block Logging captures the command
+  sent to PowerShell, the full command to be executed. Upon enabling, logs will output
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
+  \
 
-  This analytic identifies `GetProcAddress` in the script block. This is not normal to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack toolkits use GetProcAddress to obtain code execution. \
+  This analytic identifies `GetProcAddress` in the script block. This is not normal
+  to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack
+  toolkits use GetProcAddress to obtain code execution. \
 
-  In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later referenced/executed elsewhere. \
+  In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later
+  referenced/executed elsewhere. \
 
-  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message=*getprocaddress*
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `powershell_fileless_process_injection_via_getprocaddress_filter`'
-how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  During triage, review parallel processes using an EDR product or 4688 events. It
+  will be important to understand the timeline of events around this activity. Review
+  the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 Message=*getprocaddress* | stats count min(_time)
+  as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: Limited false positives. Filter as needed.
 references:
-  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
-  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
-  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
   - Malicious PowerShell
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -44,4 +54,5 @@ tags:
   - ComputerName
   - User
   - EventCode
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From 67f8c9e0f2f01aedc014fac5d92aaff5be9cca97 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-117-44>
Date: Tue, 15 Jun 2021 18:08:49 +0000
Subject: [PATCH 10/34] Added detection testing service results inPowershell
 Fileless Script Contains Base64 Encoded Content

---
 ...script_contains_base64_encoded_content.yml | 42 ++++++++++++-------
 1 file changed, 26 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
index b7806a8f0e..ca8caaed49 100644
--- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -5,29 +5,38 @@ date: '2021-06-08'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify suspicious PowerShell execution. Script Block Logging captures the command
+  sent to PowerShell, the full command to be executed. Upon enabling, logs will output
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
+  \
 
-  This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \
+  This analytic identifies `FromBase64String` within the script block. A typical malicious
+  instance will include additional code. \
 
-  Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \
+  Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....`
+  \
 
-  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message=*frombase64string*
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `powershell_fileless_script_contains_base64_encoded_content_filter`'
-how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  During triage, review parallel processes using an EDR product or 4688 events. It
+  will be important to understand the timeline of events around this activity. Review
+  the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 Message=*frombase64string* | stats count min(_time)
+  as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: False positives should be limited. Filter as needed.
 references:
-  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
-  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
-  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
   - Malicious PowerShell
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
   kill_chain_phases:
   - Exploitation
   - Privilege Escalation
@@ -45,4 +54,5 @@ tags:
   - ComputerName
   - User
   - EventCode
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From a4d3947ee336001742d5611483a0ec2d08f31c0b Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Jun 2021 13:16:17 -0600
Subject: [PATCH 11/34] System.Reflection.Assembly

System.Reflection.Assembly
---
 ..._memory_via_system_reflection_assembly.yml | 45 +++++++++++++++++++
 ...ry_via_system_reflection_assembly.test.yml | 12 +++++
 2 files changed, 57 insertions(+)
 create mode 100644 detections/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.yml
 create mode 100644 tests/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.test.yml

diff --git a/detections/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.yml
new file mode 100644
index 0000000000..2d07d40b18
--- /dev/null
+++ b/detections/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.yml
@@ -0,0 +1,45 @@
+name: PowerShell Loading .NET into Memory via System.Reflection.Assembly
+id: 85bc3f30-ca28-11eb-bd21-acde48001122
+version: 1
+date: '2021-06-10'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 Message="*[system.reflection.assembly]::load(*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `powershell_loading__net_into_memory_via_system_reflection_assembly_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives will be limited to 
+references:
+  - https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.test.yml b/tests/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.test.yml
new file mode 100644
index 0000000000..76ed48631b
--- /dev/null
+++ b/tests/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.test.yml
@@ -0,0 +1,12 @@
+name: PowerShell Loading .NET into Memory via System.Reflection.Assembly Unit Test
+tests:
+- name: PowerShell Loading .NET into Memory via System.Reflection.Assembly
+  file: endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
\ No newline at end of file

From a169f1b22612f71d27bfe41369dd6bb5db4ed117 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Jun 2021 13:26:01 -0600
Subject: [PATCH 12/34] Name fix

---
 ...g_dotnet_into_memory_via_system_reflection_assembly.yml} | 4 ++--
 ...net_into_memory_via_system_reflection_assembly.test.yml} | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)
 rename detections/endpoint/{powershell_loading__net_into_memory_via_system_reflection_assembly.yml => powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml} (94%)
 rename tests/endpoint/{powershell_loading__net_into_memory_via_system_reflection_assembly.test.yml => powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml} (62%)

diff --git a/detections/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
similarity index 94%
rename from detections/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.yml
rename to detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
index 2d07d40b18..e66a46d2d5 100644
--- a/detections/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.yml
+++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
@@ -1,4 +1,4 @@
-name: PowerShell Loading .NET into Memory via System.Reflection.Assembly
+name: PowerShell Loading DotNET into Memory via System.Reflection.Assembly
 id: 85bc3f30-ca28-11eb-bd21-acde48001122
 version: 1
 date: '2021-06-10'
@@ -14,7 +14,7 @@ search: '`powershell` EventCode=4104 Message="*[system.reflection.assembly]::loa
   | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
-  | `powershell_loading__net_into_memory_via_system_reflection_assembly_filter`'
+  | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: False positives will be limited to 
 references:
diff --git a/tests/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.test.yml b/tests/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml
similarity index 62%
rename from tests/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.test.yml
rename to tests/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml
index 76ed48631b..d6526e3865 100644
--- a/tests/endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.test.yml
+++ b/tests/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml
@@ -1,7 +1,7 @@
-name: PowerShell Loading .NET into Memory via System.Reflection.Assembly Unit Test
+name: PowerShell Loading DotNET into Memory via System.Reflection.Assembly Unit Test
 tests:
-- name: PowerShell Loading .NET into Memory via System.Reflection.Assembly
-  file: endpoint/powershell_loading__net_into_memory_via_system_reflection_assembly.yml
+- name: PowerShell Loading DotNET into Memory via System.Reflection.Assembly
+  file: endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 4476dc1705bcbb16323eeef447d5c11149300a53 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Jun 2021 13:28:27 -0600
Subject: [PATCH 13/34] spec chars

---
 ...ding_dotnet_into_memory_via_system_reflection_assembly.yml | 2 +-
 ...dotnet_into_memory_via_system_reflection_assembly.test.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
index e66a46d2d5..049e0a28a8 100644
--- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
+++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
@@ -1,4 +1,4 @@
-name: PowerShell Loading DotNET into Memory via System.Reflection.Assembly
+name: PowerShell Loading DotNET into Memory via System Reflection Assembly
 id: 85bc3f30-ca28-11eb-bd21-acde48001122
 version: 1
 date: '2021-06-10'
diff --git a/tests/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml b/tests/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml
index d6526e3865..9e922a87d7 100644
--- a/tests/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml
+++ b/tests/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml
@@ -1,6 +1,6 @@
-name: PowerShell Loading DotNET into Memory via System.Reflection.Assembly Unit Test
+name: PowerShell Loading DotNET into Memory via System Reflection Assembly Unit Test
 tests:
-- name: PowerShell Loading DotNET into Memory via System.Reflection.Assembly
+- name: PowerShell Loading DotNET into Memory via System Reflection Assembly
   file: endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'

From b83ab2b8b55bb120db63bc9206e60493c4498771 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-12-101>
Date: Tue, 15 Jun 2021 19:53:56 +0000
Subject: [PATCH 14/34] Added detection testing service results inPowerShell
 Loading DotNET into Memory via System Reflection Assembly

---
 ..._memory_via_system_reflection_assembly.yml | 42 ++++++++++++-------
 1 file changed, 27 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
index 049e0a28a8..79ec26c1d0 100644
--- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
+++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
@@ -5,28 +5,39 @@ date: '2021-06-10'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify suspicious PowerShell execution. Script Block Logging captures the command
+  sent to PowerShell, the full command to be executed. Upon enabling, logs will output
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
+  \
 
-  This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \
+  This analytic identifies the use of PowerShell loading .net assembly via reflection.
+  This is commonly found in malicious PowerShell usage, including Empire and Cobalt
+  Strike. In addition, the `load(` value may be modifed by removing `(` and it will
+  identify more events to review. \
 
-  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+  During triage, review parallel processes using an EDR product or 4688 events. It
+  will be important to understand the timeline of events around this activity. Review
+  the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 Message="*[system.reflection.assembly]::load(*"
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
+  User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter`'
-how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: False positives will be limited to 
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives will be limited to
 references:
-  - https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0
-  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
-  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
-  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0
+- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
   - Malicious PowerShell
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -42,4 +53,5 @@ tags:
   - ComputerName
   - User
   - EventCode
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From 25b1087abc891cc465c22849803f0c99871e4f83 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Jun 2021 14:02:45 -0600
Subject: [PATCH 15/34] Domain enumeration

---
 .../powershell_domain_enumeration.yml         | 44 +++++++++++++++++++
 .../powershell_domain_enumeration.test.yml    | 12 +++++
 2 files changed, 56 insertions(+)
 create mode 100644 detections/endpoint/powershell_domain_enumeration.yml
 create mode 100644 tests/endpoint/powershell_domain_enumeration.test.yml

diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml
new file mode 100644
index 0000000000..ee37ca1bac
--- /dev/null
+++ b/detections/endpoint/powershell_domain_enumeration.yml
@@ -0,0 +1,44 @@
+name: PowerShell Domain Enumeration
+id: e1866ce2-ca22-11eb-8e44-acde48001122
+version: 1
+date: '2021-06-10'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*)
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `powershell_domain_enumeration_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible there will be false positives, filter as needed.
+references:
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset: []
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/powershell_domain_enumeration.test.yml b/tests/endpoint/powershell_domain_enumeration.test.yml
new file mode 100644
index 0000000000..c90a4de8f2
--- /dev/null
+++ b/tests/endpoint/powershell_domain_enumeration.test.yml
@@ -0,0 +1,12 @@
+name: PowerShell Domain Enumeration Unit Test
+tests:
+- name: PowerShell Domain Enumeration
+  file: endpoint/powershell_domain_enumeration.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
\ No newline at end of file

From 1cf181772deb3eed7fbf653628f1f59512ad8cb6 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-143-100>
Date: Tue, 15 Jun 2021 20:53:39 +0000
Subject: [PATCH 16/34] Added detection testing service results inPowerShell
 Domain Enumeration

---
 .../powershell_domain_enumeration.yml         | 40 ++++++++++++-------
 1 file changed, 25 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml
index ee37ca1bac..f5adcd1ffb 100644
--- a/detections/endpoint/powershell_domain_enumeration.yml
+++ b/detections/endpoint/powershell_domain_enumeration.yml
@@ -5,27 +5,36 @@ date: '2021-06-10'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify suspicious PowerShell execution. Script Block Logging captures the command
+  sent to PowerShell, the full command to be executed. Upon enabling, logs will output
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
+  \
 
-  This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \
+  This analytic identifies specific PowerShell modules typically used to enumerate
+  an organizations domain or users. \
 
-  During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*)
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `powershell_domain_enumeration_filter`'
-how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  During triage, review parallel processes using an EDR product or 4688 events. It
+  will be important to understand the timeline of events around this activity. Review
+  the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*,
+  *get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time)
+  as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: It is possible there will be false positives, filter as needed.
 references:
-  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
-  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
-  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
   - Malicious PowerShell
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
@@ -41,4 +50,5 @@ tags:
   - ComputerName
   - User
   - EventCode
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From c85fc0e1c27a70c9d3afea72cfd578c8f427baff Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 16 Jun 2021 10:41:49 -0600
Subject: [PATCH 17/34] Update malicious_powershell.yml

---
 stories/malicious_powershell.yml | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/stories/malicious_powershell.yml b/stories/malicious_powershell.yml
index f84830edcf..c1bcf4a50e 100644
--- a/stories/malicious_powershell.yml
+++ b/stories/malicious_powershell.yml
@@ -1,6 +1,6 @@
 name: Malicious PowerShell
 id: 2c8ff66e-0b57-42af-8ad7-912438a403fc
-version: 4
+version: 5
 date: '2017-08-23'
 author: David Dorsey, Splunk
 type: batch
@@ -14,25 +14,26 @@ narrative: 'The searches in this Analytic Story monitor for parameters often use
   events. These factors may provide clues about whether this is a common occurrence
   of minimal concern or a rare event that may require more extensive investigation.
   Likewise, it is important to determine whether the issue is restricted to a single
-  user/system or is broader in scope.\
+  user/system or is broader in scope. \
 
   The following factors may assist you in determining whether the event is malicious:
   \
 
-  1. Country of origin\
+  1. Country of origin \
 
-  1. Responsible party\
+  1. Responsible party \
 
-  1. Fully qualified domain names associated with the external IP address\
+  1. Fully qualified domain names associated with the external IP address \
 
-  1. Registration of fully qualified domain names associated with external IP addressDetermining
-  whether it is a dynamic domain frequently visited by others and/or how third parties
+  1. Registration of fully qualified domain names associated with external IP address \
+  
+  Determining whether it is a dynamic domain frequently visited by others and/or how third parties
   categorize it can also help you answer some questions surrounding the attacker and
   details related to the external system. In addition, there are various sources--such
   as VirusTotal&#151; that can provide some reputation information on the IP address
   or domain name, which can assist in determining whether the event is malicious.
   Finally, determining whether there are other events associated with the IP address
-  may help connect data points or show other events that should be brought into scope.\
+  may help connect data points or show other events that should be brought into scope. \
 
   Gathering data on the system of interest can sometimes help you quickly determine
   whether something suspicious is happening. Some of these items include finding out
@@ -41,7 +42,7 @@ narrative: 'The searches in this Analytic Story monitor for parameters often use
   are modifications to sensitive registry keys, and whether there are any known vulnerabilities
   on the system. This information can often highlight other activity commonly seen
   in attack scenarios or give more information about how the system may have been
-  targeted.\
+  targeted. \
 
   Often, a simple inspection of the process name and path can tell you if the system
   has been compromised. For example, if `svchost.exe` is found running from a location
@@ -49,19 +50,21 @@ narrative: 'The searches in this Analytic Story monitor for parameters often use
   in plain sight when cursorily reviewing process names. Similarly, if the process
   itself seems legitimate, but the parent process is running from the temporary browser
   cache, that could be indicative of activity initiated via a compromised website
-  a user visited.\
+  a user visited. \
 
   It can also be very helpful to examine various behaviors of the process of interest
   or the parent of the process of interest. For example, if it turns out the process
   of interest is malicious, it would be good to see if the parent to that process
   spawned other processes that might be worth further scrutiny. If a process is suspect,
   a review of the network connections made in and around the time of the event and/or
-  whether the process spawned any child processes could be helpful, as well.\
+  whether the process spawned any child processes could be helpful, as well. \
 
   In the event a system is suspected of having been compromised via a malicious website,
   we suggest reviewing the browsing activity from that system around the time of the
   event. If categories are given for the URLs visited, that can help you zero in on
-  possible malicious sites.'
+  possible malicious sites. \
+  
+  Most recently we have added new content related to PowerShell Script Block logging, Windows EventCode 4104. Script block logging presents the deobfuscated and raw script executed on an endpoint. The analytics produced were tested against commonly used attack frameworks - PowerShell-Empire, Cobalt Strike and Covenant. In addition, we sampled publicly available samples that utilize PowerShell and validated coverage. The analytics are here to identify suspicious usage, cmdlets, or script values. 4104 events are enabled via the Windows registry and may generate a large volume of data if enabled globally. Enabling on critical systems or a limited set may be best. During triage of 4104 events, review parallel processes for other processes and command executed. Identify any file modifications and network communication and review accordingly. Fortunately, we get the full script to determine the level of threat identified.'
 references:
 - https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/
 - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/

From 99e3af8d1050f1310c75e24fd3190dded7060605 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 16 Jun 2021 13:48:07 -0600
Subject: [PATCH 18/34] wmi event subscription

---
 ...ect_wmi_event_subscription_persistence.yml | 52 +++++++++++++++++++
 ...mi_event_subscription_persistence.test.yml | 12 +++++
 2 files changed, 64 insertions(+)
 create mode 100644 detections/endpoint/detect_wmi_event_subscription_persistence.yml
 create mode 100644 tests/endpoint/detect_wmi_event_subscription_persistence.test.yml

diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml
new file mode 100644
index 0000000000..b06f0b56ff
--- /dev/null
+++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml
@@ -0,0 +1,52 @@
+name: Detect WMI Event Subscription Persistence
+id: 01d9a0c2-cece-11eb-ab46-acde48001122
+version: 1
+date: '2021-06-16'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation.  WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.
+  
+  All event subscriptions have three components \
+
+  1. Filter - WQL Query for the events we want. EventID = 19 \
+
+  1. Consumer - An action to take upon triggering the filter. EventID = 20 \
+
+  1. Binding - Registers a filter to a consumer. EventID = 21 \
+
+  Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
+  
+search: '`sysmon` EventID=20 Destination IN (*powershell*, *wmic*, *iex*, *rundll32.exe*, *\\temp\\*)
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer User Destination
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)` 
+| `detect_wmi_event_subscription_persistence_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with that provide WMI Event Subscription from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume.
+known_false_positives: Limited false positives will be present, filter as needed. For tuning, add any additional LOLBin's for further depth of coverage.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
+  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
+  - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/WMI-events.md
+  - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
+tags:
+  analytic_story:
+  - Suspicious WMI Use
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1546.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Destination
+  - Computer
+  - User
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/detect_wmi_event_subscription_persistence.test.yml b/tests/endpoint/detect_wmi_event_subscription_persistence.test.yml
new file mode 100644
index 0000000000..679df91653
--- /dev/null
+++ b/tests/endpoint/detect_wmi_event_subscription_persistence.test.yml
@@ -0,0 +1,12 @@
+name: Detect WMI Event Subscription Persistence Unit Test
+tests:
+- name: Detect WMI Event Subscription Persistence
+  file: endpoint/detect_wmi_event_subscription_persistence.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 90bf8bb996580516815a70e0d4130be7f0fff100 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 16 Jun 2021 15:55:58 -0600
Subject: [PATCH 19/34] Update detect_wmi_event_subscription_persistence.yml

---
 .../endpoint/detect_wmi_event_subscription_persistence.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml
index b06f0b56ff..03f2955489 100644
--- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml
+++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml
@@ -5,7 +5,7 @@ date: '2021-06-16'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation.  WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.
+description: The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation.  WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.
   
   All event subscriptions have three components \
 

From b51f29181060df6e28eced0dc81c232a0a51f5b2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Jun 2021 08:22:36 -0600
Subject: [PATCH 20/34] Update
 detect_wmi_event_subscription_persistence.test.yml

---
 .../endpoint/detect_wmi_event_subscription_persistence.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/detect_wmi_event_subscription_persistence.test.yml b/tests/endpoint/detect_wmi_event_subscription_persistence.test.yml
index 679df91653..a09016f809 100644
--- a/tests/endpoint/detect_wmi_event_subscription_persistence.test.yml
+++ b/tests/endpoint/detect_wmi_event_subscription_persistence.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/wmi_event_subscription/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file

From f1abd7b538e5b2670d04c2c4383d49902b267fab Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Jun 2021 08:59:35 -0600
Subject: [PATCH 21/34] Update detect_wmi_event_subscription_persistence.yml

---
 .../endpoint/detect_wmi_event_subscription_persistence.yml  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml
index 03f2955489..1f5b466d74 100644
--- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml
+++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml
@@ -17,16 +17,16 @@ description: The following analytic identifies the use of WMI Event Subscription
 
   Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
   
-search: '`sysmon` EventID=20 Destination IN (*powershell*, *wmic*, *iex*, *rundll32.exe*, *\\temp\\*)
+search: '`sysmon` EventID=20 
 | stats count min(_time) as firstTime max(_time) as lastTime by Computer User Destination
 | `security_content_ctime(firstTime)`
-| `security_content_ctime(lastTime)` 
+| `security_content_ctime(lastTime)`
 | `detect_wmi_event_subscription_persistence_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with that provide WMI Event Subscription from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume.
-known_false_positives: Limited false positives will be present, filter as needed. For tuning, add any additional LOLBin's for further depth of coverage.
+known_false_positives: It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin's for further depth of coverage.
 references:
   - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
   - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/

From 9396034913c6964900f343d54b5d262cc6d23de8 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Jun 2021 10:02:13 -0600
Subject: [PATCH 22/34] Remote WMI Command Attempt

---
 .../deprecated/remote_wmi_command_attempt.yml | 47 ---------------
 .../endpoint/remote_wmi_command_attempt.yml   | 57 +++++++++++++++++++
 .../remote_wmi_command_attempt.test.yml       | 12 ++++
 3 files changed, 69 insertions(+), 47 deletions(-)
 delete mode 100644 detections/deprecated/remote_wmi_command_attempt.yml
 create mode 100644 detections/endpoint/remote_wmi_command_attempt.yml
 create mode 100644 tests/endpoint/remote_wmi_command_attempt.test.yml

diff --git a/detections/deprecated/remote_wmi_command_attempt.yml b/detections/deprecated/remote_wmi_command_attempt.yml
deleted file mode 100644
index 62d8a331fc..0000000000
--- a/detections/deprecated/remote_wmi_command_attempt.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-name: Remote WMI Command Attempt
-id: 272df6de-61f1-4784-877c-1fbc3e2d0838
-version: 2
-date: '2018-12-03'
-author: Rico Valdez, Splunk
-type: batch
-datamodel:
-- Endpoint
-description: This search looks for wmic.exe being launched with parameters to operate
-  on remote systems.
-search: '| tstats `security_content_summariesonly` count values(Processes.process)
-  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe  AND
-  Processes.process= */node* by Processes.user Processes.process_name Processes.parent_process_name
-  Processes.dest  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model. Deprecated because duplicate of Remote Process Instantiation via WMI.
-known_false_positives: Administrators may use this legitimately to gather info from
-  remote systems.
-references: []
-tags:
-  analytic_story:
-  - Suspicious WMI Use
-  asset_type: Endpoint
-  cis20:
-  - CIS 3
-  - CIS 5
-  kill_chain_phases:
-  - Actions on Objectives
-  mitre_attack_id:
-  - T1047
-  nist:
-  - PR.PT
-  - PR.AT
-  - PR.AC
-  - PR.IP
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  security_domain: endpoint
diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml
new file mode 100644
index 0000000000..d0b6715b27
--- /dev/null
+++ b/detections/endpoint/remote_wmi_command_attempt.yml
@@ -0,0 +1,57 @@
+name: Remote WMI Command Attempt
+id: 272df6de-61f1-4784-877c-1fbc3e2d0838
+version: 3
+date: '2018-12-03'
+author: Rico Valdez, Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. 
+  During triage, review parallel processes for additional commands executed. Look for any file modifications before and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm execution or file modifications. Contain and isolate the endpoint as needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe
+  Processes.process=*node* by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `remote_wmi_command_attempt_filter`'
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model. Deprecated because duplicate of Remote Process Instantiation via WMI.
+known_false_positives: Administrators may use this legitimately to gather info from
+  remote systems. Filter as needed.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml
+tags:
+  analytic_story:
+  - Suspicious WMI Use
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1047
+  nist:
+  - PR.PT
+  - PR.AT
+  - PR.AC
+  - PR.IP
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user 
+  - Processes.process_name 
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.parent_process_id
+  - Processes.process_id
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/remote_wmi_command_attempt.test.yml b/tests/endpoint/remote_wmi_command_attempt.test.yml
new file mode 100644
index 0000000000..5f415d5a80
--- /dev/null
+++ b/tests/endpoint/remote_wmi_command_attempt.test.yml
@@ -0,0 +1,12 @@
+name: Remote WMI Command Attempt Unit Test
+tests:
+- name: Remote WMI Command Attempt
+  file: endpoint/remote_wmi_command_attempt.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-system.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 2e9b99ecf19c966b3c5bd619a04ac475060320e2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Jun 2021 10:34:25 -0600
Subject: [PATCH 23/34] Updates

---
 .../endpoint/process_execution_via_wmi.yml    | 20 +++++++++++--------
 ...mi_event_subscription_persistence.test.yml |  2 +-
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml
index 56fa715b55..e7e2f74623 100644
--- a/detections/endpoint/process_execution_via_wmi.yml
+++ b/detections/endpoint/process_execution_via_wmi.yml
@@ -1,16 +1,20 @@
 name: Process Execution via WMI
 id: 24869767-8579-485d-9a4f-d9ddfd8f0cac
-version: 3
+version: 4
 date: '2020-03-16'
-author: Rico Valdez, Splunk
+author: Rico Valdez, Michael Haag, Splunk
 type: batch
 datamodel: []
-description: This search looks for processes launched via WMI.
-search: '| tstats `security_content_summariesonly` count values(Processes.process)
-  as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-  where Processes.parent_process_name = *WmiPrvSE.exe by Processes.user Processes.dest
-  Processes.process_name  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `process_execution_via_wmi_filter` '
+description: The following analytic identifies `WmiPrvSE.exe` spawning a process. This typically occurs when a process is instantiated from a local or remote process using `wmic.exe`. 
+  During triage, review parallel processes for suspicious behavior or commands executed. Review the process and command-line spawning from `wmiprvse.exe`. Contain and remediate the endpoint as necessary.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=WmiPrvSE.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `process_execution_via_wmi_filter` '
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
diff --git a/tests/endpoint/detect_wmi_event_subscription_persistence.test.yml b/tests/endpoint/detect_wmi_event_subscription_persistence.test.yml
index a09016f809..679df91653 100644
--- a/tests/endpoint/detect_wmi_event_subscription_persistence.test.yml
+++ b/tests/endpoint/detect_wmi_event_subscription_persistence.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/wmi_event_subscription/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file

From 37bd2897bb170bb473a640dd11ff74d48d874a02 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Jun 2021 10:37:47 -0600
Subject: [PATCH 24/34] Update wmi_permanent_event_subscription___sysmon.yml

---
 ..._permanent_event_subscription___sysmon.yml | 26 +++++++++++++++----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
index 02ea4b7c39..4c509986d2 100644
--- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
+++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
@@ -1,20 +1,36 @@
 name: WMI Permanent Event Subscription - Sysmon
 id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9
-version: 2
+version: 3
 date: '2020-12-08'
-author: Rico Valdez, Splunk
+author: Rico Valdez, Michael Haag, Splunk
 type: batch
 datamodel: []
-description: This search looks for the creation of WMI permanent event subscriptions.
+description: This analytic looks for the creation of WMI permanent event subscriptions.
+  The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation.  WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.
+  
+  All event subscriptions have three components \
+
+  1. Filter - WQL Query for the events we want. EventID = 19 \
+
+  1. Consumer - An action to take upon triggering the filter. EventID = 20 \
+
+  1. Binding - Registers a filter to a consumer. EventID = 21 \
+
+  Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
+
 search: '`sysmon` EventCode=21 | rename host as dest | table _time, dest, user, Operation,
   EventType, Query, Consumer, Filter | `wmi_permanent_event_subscription___sysmon_filter`'
 how_to_implement: To successfully implement this search, you must be collecting Sysmon
   data using Sysmon version 6.1 or greater and have Sysmon configured to generate
-  alerts for WMI activity. In addition, you must have at least version 6.0.4 of the
+  alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the
   Sysmon TA installed to properly parse the fields.
 known_false_positives: Although unlikely, administrators may use event subscriptions
   for legitimate purposes.
-references: []
+references: 
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
+  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
+  - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/WMI-events.md
+  - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
 tags:
   analytic_story:
   - Suspicious WMI Use

From 8e9ad3a42b432c16bb48b67f639c7b6f764c0892 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Jun 2021 10:49:34 -0600
Subject: [PATCH 25/34] Update script_execution_via_wmi.yml

---
 .../endpoint/script_execution_via_wmi.yml     | 34 +++++++++++++------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml
index 572bca9e10..333f3f0622 100644
--- a/detections/endpoint/script_execution_via_wmi.yml
+++ b/detections/endpoint/script_execution_via_wmi.yml
@@ -1,23 +1,37 @@
 name: Script Execution via WMI
 id: aa73f80d-d728-4077-b226-81ea0c8be589
-version: 3
+version: 4
 date: '2020-03-16'
-author: Rico Valdez, Splunk
+author: Rico Valdez, Michael Haag, Splunk
 type: batch
 datamodel: []
-description: This search looks for scripts launched via WMI.
-search: '| tstats `security_content_summariesonly` count values(Processes.process)
-  as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-  where Processes.process_name = "scrcons.exe" by Processes.user Processes.dest Processes.process_name  |
-  `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  `script_execution_via_wmi_filter` '
+description: 'This search looks for scripts launched via WMI.
+  1. It is located in the %windir%\System32\wbem directory. “wbem” stands for “Web-Based Enterprise Management” and this directory houses core components related to Windows Management Instrumentation (WMI), which is Microsoft’s implementation of the WBEM standard \ 
+
+  1. It has the following file description: WMI Standard Event Consumer - scripting. An event consumer is a WMI component that performs an action in response to a trigger. In the case of scrcons.exe, it executes Windows Script Host (WSH) code (i.e., JScript and VBScript) in response to some event occurring. More specifically, it is the code that implements the ActiveScriptEventConsumer WMI event class \
+  
+  1. Because WMI is implemented as DCOM, scrcons.exe is expected to launch as a child process of the DcomLaunch service (command line: %windir%\system32\svchost.exe -k DcomLaunch -p), as was the case in this instance \ 
+  
+  1. It is expected to have the following command line: %windir%\System32\wbem\scrcons.exe -Embedding \ 
+  
+  1. The process is expected to execute as NT AUTHORITY\SYSTEM and any child processes of scrcons.exe are expected to execute with system privileges, which was also the case with dllhost.exe.'
+
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `script_execution_via_wmi_filter` '
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
   field in the Endpoint data model.
 known_false_positives: Although unlikely, administrators may use wmi to launch scripts
-  for legitimate purposes.
-references: []
+  for legitimate purposes. Filter as needed.
+references:
+  - https://redcanary.com/blog/child-processes/
 tags:
   analytic_story:
   - Suspicious WMI Use

From 1d95339bbdf66195eb93b61c142a320d1dc52466 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Jun 2021 10:52:51 -0600
Subject: [PATCH 26/34] Update script_execution_via_wmi.yml

---
 detections/endpoint/script_execution_via_wmi.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml
index 333f3f0622..5f3a689c87 100644
--- a/detections/endpoint/script_execution_via_wmi.yml
+++ b/detections/endpoint/script_execution_via_wmi.yml
@@ -5,12 +5,13 @@ date: '2020-03-16'
 author: Rico Valdez, Michael Haag, Splunk
 type: batch
 datamodel: []
-description: 'This search looks for scripts launched via WMI.
-  1. It is located in the %windir%\System32\wbem directory. “wbem” stands for “Web-Based Enterprise Management” and this directory houses core components related to Windows Management Instrumentation (WMI), which is Microsoft’s implementation of the WBEM standard \ 
+description: 'This search looks for scripts launched via WMI. \
 
-  1. It has the following file description: WMI Standard Event Consumer - scripting. An event consumer is a WMI component that performs an action in response to a trigger. In the case of scrcons.exe, it executes Windows Script Host (WSH) code (i.e., JScript and VBScript) in response to some event occurring. More specifically, it is the code that implements the ActiveScriptEventConsumer WMI event class \
+  1. It is located in the %windir%\System32\wbem directory. "wbem" stands for "Web-Based Enterprise Management" and this directory houses core components related to Windows Management Instrumentation (WMI), which is Microsoft’s implementation of the WBEM standard \ 
+
+  1. It has the following file description - WMI Standard Event Consumer - scripting. An event consumer is a WMI component that performs an action in response to a trigger. In the case of scrcons.exe, it executes Windows Script Host (WSH) code (i.e., JScript and VBScript) in response to some event occurring. More specifically, it is the code that implements the ActiveScriptEventConsumer WMI event class \
   
-  1. Because WMI is implemented as DCOM, scrcons.exe is expected to launch as a child process of the DcomLaunch service (command line: %windir%\system32\svchost.exe -k DcomLaunch -p), as was the case in this instance \ 
+  1. Because WMI is implemented as DCOM, scrcons.exe is expected to launch as a child process of the DcomLaunch service (command line %windir%\system32\svchost.exe -k DcomLaunch -p), as was the case in this instance \ 
   
   1. It is expected to have the following command line: %windir%\System32\wbem\scrcons.exe -Embedding \ 
   

From 7d543761b66599e16c17780cc25a1454f6373680 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-11-82>
Date: Fri, 18 Jun 2021 16:53:50 +0000
Subject: [PATCH 27/34] Added detection testing service results inDetect WMI
 Event Subscription Persistence

---
 ...ect_wmi_event_subscription_persistence.yml | 48 +++++++++++--------
 1 file changed, 29 insertions(+), 19 deletions(-)

diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml
index 1f5b466d74..608dae8799 100644
--- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml
+++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml
@@ -5,8 +5,14 @@ date: '2021-06-16'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation.  WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.
-  
+description: 'The following analytic identifies the use of WMI Event Subscription
+  to establish persistence or perform privilege escalation.  WMI can be used to install
+  event filters, providers, consumers, and bindings that execute code when a defined
+  event occurs. WMI subscription execution is proxied by the WMI Provider Host process
+  (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic
+  is restricted by commonly added process execution and a path. If the volume is low
+  enough, remove the values and flag on any new subscriptions.
+
   All event subscriptions have three components \
 
   1. Filter - WQL Query for the events we want. EventID = 19 \
@@ -15,27 +21,30 @@ description: The following analytic identifies the use of WMI Event Subscription
 
   1. Binding - Registers a filter to a consumer. EventID = 21 \
 
-  Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
-  
-search: '`sysmon` EventID=20 
-| stats count min(_time) as firstTime max(_time) as lastTime by Computer User Destination
-| `security_content_ctime(firstTime)`
-| `security_content_ctime(lastTime)`
-| `detect_wmi_event_subscription_persistence_filter`'
+  Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding.
+  It may be pertinent to review all 3 to identify the flow of execution. In addition,
+  EventCode 4104 may assist with any other PowerShell script usage that registered
+  the subscription.'
+search: '`sysmon` EventID=20 | stats count min(_time) as firstTime max(_time) as lastTime
+  by Computer User Destination | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_wmi_event_subscription_persistence_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with that provide WMI Event Subscription from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume.
-known_false_positives: It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin's for further depth of coverage.
+  logs with that provide WMI Event Subscription from your endpoints. If you are using
+  Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID
+  19, 20 and 21. Tune and filter known good to limit the volume.
+known_false_positives: It is possible some applications will create a consumer and
+  may be required to be filtered. For tuning, add any additional LOLBin's for further
+  depth of coverage.
 references:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
-  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
-  - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/WMI-events.md
-  - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
+- https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
+- https://github.com/trustedsec/SysmonCommunityGuide/blob/master/WMI-events.md
+- https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
 tags:
   analytic_story:
   - Suspicious WMI Use
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -49,4 +58,5 @@ tags:
   - Destination
   - Computer
   - User
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From 2b9f393585582719a0bb1a4d48f57a25f39a2feb Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Jun 2021 10:54:52 -0600
Subject: [PATCH 28/34] Update script_execution_via_wmi.yml

---
 detections/endpoint/script_execution_via_wmi.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml
index 5f3a689c87..c3ddaed191 100644
--- a/detections/endpoint/script_execution_via_wmi.yml
+++ b/detections/endpoint/script_execution_via_wmi.yml
@@ -7,13 +7,13 @@ type: batch
 datamodel: []
 description: 'This search looks for scripts launched via WMI. \
 
-  1. It is located in the %windir%\System32\wbem directory. "wbem" stands for "Web-Based Enterprise Management" and this directory houses core components related to Windows Management Instrumentation (WMI), which is Microsoft’s implementation of the WBEM standard \ 
+  1. It is located in the \System32\wbem directory. "wbem" stands for "Web-Based Enterprise Management" and this directory houses core components related to Windows Management Instrumentation (WMI), which is Microsoft’s implementation of the WBEM standard \ 
 
   1. It has the following file description - WMI Standard Event Consumer - scripting. An event consumer is a WMI component that performs an action in response to a trigger. In the case of scrcons.exe, it executes Windows Script Host (WSH) code (i.e., JScript and VBScript) in response to some event occurring. More specifically, it is the code that implements the ActiveScriptEventConsumer WMI event class \
   
-  1. Because WMI is implemented as DCOM, scrcons.exe is expected to launch as a child process of the DcomLaunch service (command line %windir%\system32\svchost.exe -k DcomLaunch -p), as was the case in this instance \ 
+  1. Because WMI is implemented as DCOM, scrcons.exe is expected to launch as a child process of the DcomLaunch service (command line \system32\svchost.exe -k DcomLaunch -p), as was the case in this instance \ 
   
-  1. It is expected to have the following command line: %windir%\System32\wbem\scrcons.exe -Embedding \ 
+  1. It is expected to have the following command line: \System32\wbem\scrcons.exe -Embedding \ 
   
   1. The process is expected to execute as NT AUTHORITY\SYSTEM and any child processes of scrcons.exe are expected to execute with system privileges, which was also the case with dllhost.exe.'
 

From a7b838d473bef61fb81cf24fffd039dc5129b052 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Jun 2021 10:58:38 -0600
Subject: [PATCH 29/34] Update script_execution_via_wmi.yml

---
 detections/endpoint/script_execution_via_wmi.yml | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml
index c3ddaed191..10e9aa117c 100644
--- a/detections/endpoint/script_execution_via_wmi.yml
+++ b/detections/endpoint/script_execution_via_wmi.yml
@@ -5,18 +5,7 @@ date: '2020-03-16'
 author: Rico Valdez, Michael Haag, Splunk
 type: batch
 datamodel: []
-description: 'This search looks for scripts launched via WMI. \
-
-  1. It is located in the \System32\wbem directory. "wbem" stands for "Web-Based Enterprise Management" and this directory houses core components related to Windows Management Instrumentation (WMI), which is Microsoft’s implementation of the WBEM standard \ 
-
-  1. It has the following file description - WMI Standard Event Consumer - scripting. An event consumer is a WMI component that performs an action in response to a trigger. In the case of scrcons.exe, it executes Windows Script Host (WSH) code (i.e., JScript and VBScript) in response to some event occurring. More specifically, it is the code that implements the ActiveScriptEventConsumer WMI event class \
-  
-  1. Because WMI is implemented as DCOM, scrcons.exe is expected to launch as a child process of the DcomLaunch service (command line \system32\svchost.exe -k DcomLaunch -p), as was the case in this instance \ 
-  
-  1. It is expected to have the following command line: \System32\wbem\scrcons.exe -Embedding \ 
-  
-  1. The process is expected to execute as NT AUTHORITY\SYSTEM and any child processes of scrcons.exe are expected to execute with system privileges, which was also the case with dllhost.exe.'
-
+description: This search looks for scripts launched via WMI. 
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe
   by Processes.dest Processes.user Processes.parent_process Processes.process_name

From 35492c75fb04e2957536964928b293fa0742799d Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Jun 2021 11:00:34 -0600
Subject: [PATCH 30/34] wrong data

---
 tests/endpoint/remote_wmi_command_attempt.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/remote_wmi_command_attempt.test.yml b/tests/endpoint/remote_wmi_command_attempt.test.yml
index 5f415d5a80..8f4134e786 100644
--- a/tests/endpoint/remote_wmi_command_attempt.test.yml
+++ b/tests/endpoint/remote_wmi_command_attempt.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file

From f612fd6d3e8599f98bf3dcdf8eaaa8e14f7a4937 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-87-155>
Date: Fri, 18 Jun 2021 17:22:24 +0000
Subject: [PATCH 31/34] Added detection testing service results inRemote WMI
 Command Attempt

---
 .../endpoint/remote_wmi_command_attempt.yml   | 26 +++++++++++--------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml
index d0b6715b27..b1a9dfb44c 100644
--- a/detections/endpoint/remote_wmi_command_attempt.yml
+++ b/detections/endpoint/remote_wmi_command_attempt.yml
@@ -6,15 +6,16 @@ author: Rico Valdez, Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. 
-  During triage, review parallel processes for additional commands executed. Look for any file modifications before and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm execution or file modifications. Contain and isolate the endpoint as needed.
+description: The following analytic identifies usage of `wmic.exe` spawning a local
+  or remote process, identified by the `node` switch. During triage, review parallel
+  processes for additional commands executed. Look for any file modifications before
+  and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm
+  execution or file modifications. Contain and isolate the endpoint as needed.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe
-  Processes.process=*node* by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+  Processes.process=*node* by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `remote_wmi_command_attempt_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -24,7 +25,7 @@ how_to_implement: You must be ingesting data that records process activity from
 known_false_positives: Administrators may use this legitimately to gather info from
   remote systems. Filter as needed.
 references:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml
 tags:
   analytic_story:
   - Suspicious WMI Use
@@ -47,11 +48,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.user 
-  - Processes.process_name 
+  - Processes.user
+  - Processes.process_name
   - Processes.parent_process_name
   - Processes.dest
   - Processes.parent_process
   - Processes.parent_process_id
   - Processes.process_id
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log

From ad85879e896e36f57bd9ef2ac11ed9221685e94c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Jun 2021 13:41:54 -0600
Subject: [PATCH 32/34] Fixing descriptions

---
 ...ect_wmi_event_subscription_persistence.yml |  8 ++--
 .../powershell_creating_thread_mutex.yml      | 20 ++++-----
 .../powershell_processing_stream_of_data.yml  | 20 ++++-----
 ...wershell_using_memory_as_backing_store.yml | 21 ++++-----
 .../recon_avproduct_through_pwh_or_wmi.yml    | 19 ++++----
 .../endpoint/recon_using__wmi_class.yml       | 44 ------------------
 detections/endpoint/recon_using_wmi_class.yml | 45 +++++++++++++++++++
 .../wmi_recon_running_process_or_services.yml | 18 ++++----
 ...est.yml => recon_using_wmi_class.test.yml} |  4 +-
 9 files changed, 101 insertions(+), 98 deletions(-)
 delete mode 100644 detections/endpoint/recon_using__wmi_class.yml
 create mode 100644 detections/endpoint/recon_using_wmi_class.yml
 rename tests/endpoint/{recon_using__wmi_class.test.yml => recon_using_wmi_class.test.yml} (84%)

diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml
index 608dae8799..8636a817cc 100644
--- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml
+++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml
@@ -36,10 +36,10 @@ known_false_positives: It is possible some applications will create a consumer a
   may be required to be filtered. For tuning, add any additional LOLBin's for further
   depth of coverage.
 references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
-- https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
-- https://github.com/trustedsec/SysmonCommunityGuide/blob/master/WMI-events.md
-- https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
+  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
+  - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/WMI-events.md
+  - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
 tags:
   analytic_story:
   - Suspicious WMI Use
diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml
index 00657f2276..201f863d4a 100644
--- a/detections/endpoint/powershell_creating_thread_mutex.yml
+++ b/detections/endpoint/powershell_creating_thread_mutex.yml
@@ -4,22 +4,22 @@ version: 1
 date: '2021-06-10'
 author: Teoderick Contreras, Splunk
 type: batch
-datamodel:
-- Endpoint
-description: This search is to detect suspicious powershell script that using mutex
-  function. This function is commonly seen in some obfuscated powershell script to
-  make sure that only one instance of there process is running to a compromise machine
-  which is also a good indicator to check why powershell script is using it.
+datamodel: []
+description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to
+  make sure that only one instance of there process is running on a compromise machine.
+  During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 search: '`powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs  from your endpoints. make sure you enable needed
-  registry to monitor this event.
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: powershell developer may used this function in their script
   for instance checking too.
 references:
-- https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/
+  - https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
   - Malicious PowerShell
diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml
index 8a5d4c1f61..ecc9b839f5 100644
--- a/detections/endpoint/powershell_processing_stream_of_data.yml
+++ b/detections/endpoint/powershell_processing_stream_of_data.yml
@@ -4,22 +4,22 @@ version: 1
 date: '2021-06-10'
 author: Teoderick Contreras, Splunk
 type: batch
-datamodel:
-- Endpoint
-description: this search is to detect suspicious powershell that processing compressed
-  stream data. This technique was seen in obfuscated powershell or powershell with
-  embedded .net or binary files that are stream flated and will be deflated during
-  execution.
+datamodel: []
+description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically
+  found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution.
+  During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*"
   OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
   as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs  from your endpoints. make sure you enable needed
-  registry to monitor this event.
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: powershell may used this function to process compressed data.
 references:
-- https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9
+  - https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
   - Malicious PowerShell
diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml
index 32678956f5..1b3be4a693 100644
--- a/detections/endpoint/powershell_using_memory_as_backing_store.yml
+++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml
@@ -4,23 +4,24 @@ version: 1
 date: '2021-06-10'
 author: Teoderick Contreras, Splunk
 type: batch
-datamodel:
-- Endpoint
-description: this search is to detect suspicious powershell script that using memory
-  stream as new object backstore. This technique is commonly seen in malicious powershell
-  contain a stream flate data and will be decompressed in memory to run or drop the
-  actual payload to the compromise machine.
+datamodel: []
+description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using memory
+  stream as new object backstore. The malicious PowerShell script will contain stream flate data and will be decompressed in memory to run or drop the
+  actual payload.
+  During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 search: '`powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*" | stats
   count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
   User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_using_memory_as_backing_store_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs  from your endpoints. make sure you enable needed
-  registry to monitor this event.
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: powershell may used this function to store out object into
   memory.
 references:
-- https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/
+  - https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
   - Malicious PowerShell
diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
index 843a8a7465..49031821e8 100644
--- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
+++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
@@ -4,21 +4,22 @@ version: 1
 date: '2021-06-10'
 author: Teoderick Contreras, Splunk
 type: batch
-datamodel:
-- Endpoint
-description: This search is to detect a powershell script that do a recon or checking
-  to the av product install on the machine. This technique is commonly seen in APT
-  or malware like ransomware to list all security product and disable it.
+datamodel: []
+description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104 performing checks to identify anti-virus products installed on the endpoint. This technique is commonly found in malware
+  and APT events where the adversary will map all running security applications or services.
+  During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*"
   OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time)
   as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs from your endpoints. make sure you enable needed registry
-  to monitor this event.
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: network administrator may used this command for checking purposes
 references:
-- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
+  - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ 
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
   - Ransomware
diff --git a/detections/endpoint/recon_using__wmi_class.yml b/detections/endpoint/recon_using__wmi_class.yml
deleted file mode 100644
index 7d46974ce0..0000000000
--- a/detections/endpoint/recon_using__wmi_class.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-name: Recon Using  WMI Class
-id: 018c1972-ca07-11eb-9473-acde48001122
-version: 1
-date: '2021-06-10'
-author: Teoderick Contreras, Splunk
-type: batch
-datamodel:
-- Endpoint
-description: This search is to detect a powershell script that do a recon to the targetted
-  or compromised machine. This technique is common nowadays to know the running process,
-  services
-search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*")
-  AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*"
-  OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*"
-  OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
-  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `recon_using__wmi_class_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs from your endpoints. make sure you enable needed registry
-  to monitor this event.
-known_false_positives: network administrator may used this command for checking purposes
-references:
-- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
-tags:
-  analytic_story:
-  - Malicious PowerShell
-  kill_chain_phases:
-  - Reconnaissance
-  mitre_attack_id:
-  - T1592
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventCode
-  - Message
-  - ComputerName
-  - User
-  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml
new file mode 100644
index 0000000000..3fe8b5eaca
--- /dev/null
+++ b/detections/endpoint/recon_using_wmi_class.yml
@@ -0,0 +1,45 @@
+name: Recon Using WMI Class
+id: 018c1972-ca07-11eb-9473-acde48001122
+version: 1
+date: '2021-06-10'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel: []
+description: The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised
+  machine.
+  During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*")
+  AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*"
+  OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*"
+  OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
+  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: network administrator may used this command for checking purposes
+references:
+  - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
+  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+  - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+  - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1592
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml
index 6833b18e0e..70a5842212 100644
--- a/detections/endpoint/wmi_recon_running_process_or_services.yml
+++ b/detections/endpoint/wmi_recon_running_process_or_services.yml
@@ -4,22 +4,22 @@ version: 1
 date: '2021-06-14'
 author: Teoderick Contreras, Splunk
 type: batch
-datamodel:
-- Endpoint
-description: This seearch is to detect a suspicious powershell/wmi query to recon
-  running process and running services. This technique is commonly seen in malware
-  and apt attack to mapped all running security application or services on the compromised
+datamodel: []
+description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware
+  and APT events where the adversary will map all running security applications or services on the compromised
   machine.
+  During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 search: '`powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*"
   OR Message="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as
   lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs from your endpoints. make sure you enable needed registry
-  to monitor this event.
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: network administrator may used this command for checking purposes
 references:
-- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
+  - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ 
+  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
+  - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/WMI-events.md
+  - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
 tags:
   analytic_story:
   - Malicious PowerShell
diff --git a/tests/endpoint/recon_using__wmi_class.test.yml b/tests/endpoint/recon_using_wmi_class.test.yml
similarity index 84%
rename from tests/endpoint/recon_using__wmi_class.test.yml
rename to tests/endpoint/recon_using_wmi_class.test.yml
index 7d7aece511..336de7244c 100644
--- a/tests/endpoint/recon_using__wmi_class.test.yml
+++ b/tests/endpoint/recon_using_wmi_class.test.yml
@@ -1,7 +1,7 @@
 name: Recon Using  WMI Class Unit Test
 tests:
-- name: Recon Using  WMI Class
-  file: endpoint/recon_using__wmi_class.yml
+- name: Recon Using WMI Class
+  file: endpoint/recon_using_wmi_class.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 285b2c50060f2573432b061fa9273010db01a575 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Wed, 23 Jun 2021 11:57:28 -0500
Subject: [PATCH 33/34] Update process_execution_via_wmi.yml

---
 detections/endpoint/process_execution_via_wmi.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml
index e7e2f74623..427b80a628 100644
--- a/detections/endpoint/process_execution_via_wmi.yml
+++ b/detections/endpoint/process_execution_via_wmi.yml
@@ -4,7 +4,8 @@ version: 4
 date: '2020-03-16'
 author: Rico Valdez, Michael Haag, Splunk
 type: batch
-datamodel: []
+datamodel: 
+- Endpoint
 description: The following analytic identifies `WmiPrvSE.exe` spawning a process. This typically occurs when a process is instantiated from a local or remote process using `wmic.exe`. 
   During triage, review parallel processes for suspicious behavior or commands executed. Review the process and command-line spawning from `wmiprvse.exe`. Contain and remediate the endpoint as necessary.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)

From b276ecf8fbfeaa9f1e4088aeeb1337a2ab022689 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Wed, 23 Jun 2021 12:41:34 -0500
Subject: [PATCH 34/34] Update script_execution_via_wmi.yml

---
 detections/endpoint/script_execution_via_wmi.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml
index 10e9aa117c..6d78200194 100644
--- a/detections/endpoint/script_execution_via_wmi.yml
+++ b/detections/endpoint/script_execution_via_wmi.yml
@@ -4,7 +4,8 @@ version: 4
 date: '2020-03-16'
 author: Rico Valdez, Michael Haag, Splunk
 type: batch
-datamodel: []
+datamodel:
+- Endpoint
 description: This search looks for scripts launched via WMI. 
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe