removing originalfilename artifacts

detections/endpoint/detect_renamed_7_zip.yml

@@ -65,13 +65,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - dest
-  - User
-  - parent_process_name
-  - process_name
-  - OriginalFileName
-  - process_path
-  - CommandLine
-  - Product
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint

detections/endpoint/detect_renamed_psexec.yml

@@ -73,13 +73,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - dest
-  - User
-  - parent_process_name
-  - process_name
-  - OriginalFileName
-  - process_path
-  - CommandLine
-  - Product
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint

detections/endpoint/detect_renamed_rclone.yml

@@ -18,10 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
   | `detect_renamed_rclone_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives should be limited as this analytic identifies
   renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business
   use case.
@@ -70,10 +67,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - OriginalFileName
-  - process_name
-  - process_path
-  - CommandLine
-  - dest
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint

detections/endpoint/detect_sharphound_usage.yml

@@ -7,8 +7,8 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic identifies SharpHound binary usage by using the
-  `OriginalFileName`. In addition to renaming the PE, other coverage is available
-  to detect command-line arguments. This particular analytic looks for the OriginalFileName
+  original filena,e. In addition to renaming the PE, other coverage is available
+  to detect command-line arguments. This particular analytic looks for the original_file_name
   of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe
   have different original filenames. Dependent upon the operator, the code may be
   re-compiled and the attributes removed or changed to anything else. During triage,

detections/endpoint/dump_lsass_via_procdump.yml

@@ -9,7 +9,7 @@ datamodel:
 description: 'Detect procdump.exe dumping the lsass process. This query looks for
   both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
   file with all process memory. Both are highly suspect and should be reviewed. This
-  query does not monitor for the internal name (OriginalFileName=procdump) of the
+  query does not monitor for the internal name (original_file_name=procdump) of the
   PE or look for procdump64.exe. Modify the query as needed.\
 
   During triage, confirm this is procdump.exe executing. If it is the first time a

detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml

@@ -4,7 +4,8 @@ version: 2
 date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+  - Endpoint
 description: The following analytic identifies DLLHost.exe with no command line arguments.
   It is unusual for DLLHost.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.

detections/endpoint/suspicious_rundll32_rename.yml

@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic identifies renamed instances of rundll32.exe executing.
   rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During
   investigation, validate it is the legitimate rundll32.exe executing and what script
-  content it is loading. This query relies on the OriginalFileName from Sysmon, or
+  content it is loading. This query relies on the original filename or
   internal name from the PE meta data. Expand the query as needed by looking for specific
   command line arguments outlined in other analytics.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)