Branch was auto-updated.

detections/endpoint/csc_net_on_the_fly_compilation.yml

@@ -0,0 +1,72 @@
+name: CSC Net On The Fly Compilation
+id: ea73128a-43ab-11ec-9753-acde48001122
+version: 1
+date: '2021-11-12'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: this analytic is to detect a suspicious compile before delivery approach
+  of .net compiler csc.exe. This technique was seen in several adversaries, malware
+  and even in red teams to take advantage the csc.exe .net compiler tool to compile
+  on the fly a malicious .net code to evade detection from security product. This
+  is a good hunting query to check further the file or process created after this
+  event and check the file path that passed to csc.exe which is the .net code. Aside
+  from that, powershell is capable of using this compiler in executing .net code in
+  a powershell script so filter on that case is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_csc` Processes.process
+  = "*/noconfig*" Processes.process = "*/fullpaths*" Processes.process = "*@*" by
+  Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `csc_net_on_the_fly_compilation_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: A network operator or systems administrator may utilize an
+  automated powershell script taht execute .net code that may generate false positive.
+  filter is needed.
+references:
+- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/
+- https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1027.004
+  - T1027
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: csc.exe with commandline $process$ to compile .net code on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/firewall_allowed_program_enable.yml

@@ -0,0 +1,69 @@
+name: Firewall Allowed Program Enable
+id: 9a8f63a8-43ac-11ec-904c-acde48001122
+version: 1
+date: '2021-11-12'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic detects a potential suspicious modification of firewall
+  rule allowing to execute specific application. This technique was identified when
+  an adversary and red teams to bypassed firewall file execution restriction in a
+  targetted host. Take note that this event or command can run by administrator during
+  testing or allowing legitimate tool or application.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*"
+  Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process
+  = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `firewall_allowed_program_enable_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: A network operator or systems administrator may utilize an
+  automated or manual execution of this firewall rule that may generate false positives.
+  Filter as needed.
+references:
+- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1562.004
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: firewall allowed program commandline $process$ of $process_name$ on $dest$
+    by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/high_frequency_copy_of_files_in_network_share.yml

@@ -0,0 +1,69 @@
+name: High Frequency Copy Of Files In Network Share
+id: 40925f12-4709-11ec-bb43-acde48001122
+version: 1
+date: '2021-11-16'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious high frequency copying/moving
+  of files in network share as part of information sabotage. This anomaly event can
+  be a good indicator of insider trying to sabotage data by transfering classified
+  or internal files within network share to exfitrate it after or to lure evidence
+  of insider attack to other user. This behavior may catch several noise if network
+  share is a common place for classified or internal document processing.
+search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key")
+  Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
+  "0x2" |  bucket _time span=5m | stats values(Relative_Target_Name) as valRelativeTargetName,
+  values(Share_Name) as valShareName, values(Object_Type) as valObjectType, values(Access_Mask)
+  as valAccessmask, values(src_port) as valSrcPort, values(Source_Address) as valSrcAddress
+  count as numShareName by dest, _time, EventCode, user | eventstats avg(numShareName)
+  as avgShareName, stdev(numShareName) as stdShareName, count as numSlots by dest,
+  _time, EventCode, user |  eval upperThreshold=(avgShareName + stdShareName *3) |  eval
+  isOutlier=if(avgShareName > 20 and avgShareName >= upperThreshold, 1, 0) |  search
+  isOutlier=1 | `high_frequency_copy_of_files_in_network_share_filter`'
+how_to_implement: o successfully implement this search, you need to be ingesting Windows
+  Security Event Logs with 5145 EventCode enabled. The Windows TA is also required.
+  Also enable the object Audit access success/failure in your group policy.
+known_false_positives: this behavior may seen in normal transfer of file within network
+  if network share is common place for sharing documents.
+references:
+- https://attack.mitre.org/techniques/T1537/
+tags:
+  analytic_story:
+  - Information Sabotage
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/high_copy_files_in_net_share/security.log
+  kill_chain_phases:
+  - Exfiltration
+  mitre_attack_id:
+  - T1537
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Share_Name
+  - Relative_Target_Name
+  - Object_Type
+  - Access_Mask
+  - user
+  - src_port
+  - Source_Address
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  message: high frequency copy of document in network share $Share_Name$ from $Source_Address$
+    by $user$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/loading_of_dynwrapx_module.yml

@@ -0,0 +1,74 @@
+name: Loading Of Dynwrapx Module
+id: eac5e8ba-4857-11ec-9371-acde48001122
+version: 1
+date: '2021-11-18'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: DynamicWrapperX is an ActiveX component that can be used in a script
+  to call Windows API functions, but it requires the dynwrapx.dll to be installed
+  and registered. With that, registering or loading dynwrapx.dll to a host highly
+  suspect. Why is it needed? In most malicious instances, During triage, review parallel
+  processes and pivot on the process_guid. Review the registry for any suspicious
+  modifications meant to load dynwrapx.dll. Identify any suspicious module loads of
+  dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript.
+search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName
+  = "dynwrapx.dll" OR  Product = "DynamicWrapperX") | stats count min(_time) as firstTime
+  max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name
+  Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `loading_of_dynwrapx_module_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
+  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
+  latest TA for the endpoint product.
+known_false_positives: False positives should be limited, however it is possible to
+  filter by Processes.process_name and specific processes (ex. wscript.exe). Filter
+  as needed. This may need modification based on EDR telemetry and how it brings in
+  registry data. For example, removal of (Default).
+references:
+- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
+- https://www.script-coding.com/dynwrapx_eng.html
+- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
+- https://tria.ge/210929-ap75vsddan
+- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
+tags:
+  analytic_story:
+  - Remcos
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  - T1055.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - OriginalFileName
+  - Product
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: dynwrapx.dll loaded by process $process_name$ on $Computer$
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/network_discovery_using_route_windows_app.yml

@@ -0,0 +1,66 @@
+name: Network Discovery Using Route Windows App
+id: dd83407e-439f-11ec-ab8e-acde48001122
+version: 1
+date: '2021-11-12'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic look for a spawned process of route.exe windows application.
+  Adversaries and red teams alike abuse this application the recon or do a network
+  discovery on a target host. but one possible false positive might be an automated
+  tool used by a system administator or a powershell script in amazon ec2 config services.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_route` by Processes.dest
+  Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_discovery_using_route_windows_app_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: A network operator or systems administrator may utilize an
+  automated host discovery application that may generate false positives or an amazon
+  ec2 script that uses this application. Filter as needed.
+references:
+- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1016
+  - T1016.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Network Connection discovery on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/runas_execution_in_commandline.yml

@@ -0,0 +1,68 @@
+name: Runas Execution in CommandLine
+id: 4807e716-43a4-11ec-a0e7-acde48001122
+version: 1
+date: '2021-11-12'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic look for a spawned runas.exe process with a administrator
+  user option parameter. This parameter was abused by adversaries, malware author
+  or even red teams to gain elevated privileges in target host. This is a good hunting
+  query to figure out privilege escalation tactics that may used for different stages
+  like lateral movement but take note that administrator may use this command in purpose
+  so its better to see other event context before and after this analytic.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_runas` AND Processes.process
+  = "*/user:*" AND Processes.process = "*admin*" by Processes.dest Processes.user
+  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `runas_execution_in_commandline_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: A network operator or systems administrator may utilize an
+  automated or manual execute this command that may generate false positives. filter
+  is needed.
+references:
+- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#
+tags:
+  analytic_story:
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1134
+  - T1134.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - stage:Privilege Escalation
+  message: elevated process using runas on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml

@@ -38,7 +38,7 @@ tags:
   - Stage:Command And Control
   - Consequence:Loss Of Control
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
   impact: 80
   kill_chain_phases:
   - Actions on Objectives

detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml

@@ -44,7 +44,7 @@ tags:
   - Stage:Credential Access
   - Consequence:Loss Of Control
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
   impact: 80
   kill_chain_phases:
   - Actions on Objectives

detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml

@@ -37,7 +37,7 @@ tags:
   - Stage:Credential Access
   - Consequence:Loss Of Control
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log
   impact: 80
   kill_chain_phases:
   - Actions on Objectives

detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml

@@ -37,7 +37,7 @@ tags:
   - Stage:Credential Access
   - Consequence:Loss Of Control
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log
   impact: 90
   kill_chain_phases:
   - Actions on Objectives

detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml

@@ -0,0 +1,68 @@
+name: Suspicious Process DNS Query Known Abuse Web Services
+id: 3cf0dc36-484d-11ec-a6bc-acde48001122
+version: 1
+date: '2021-11-18'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious process having a dns query on
+  known abuse text paste web services, or VoIP, instant messaging and digital distribution
+  platform to download some files. This technique is abused by adversaries, malware
+  attacker and red team to download a malicious file on the target host. This is a
+  good TTP indicator for possible initial access technique. Noise and false positive
+  can be seen if the following instant messaging is allowed or common application
+  in corporate network.
+search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*",
+  "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe",
+  "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image
+  QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`'
+how_to_implement: his detection relies on sysmon logs with the Event ID 7, Driver
+  loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll
+  is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query.
+  We suggest to run this detection at least once a day over the last 14 days.
+known_false_positives: Noise and false positive can be seen if the following instant
+  messaging is allowed to use within corporate network. filter is needed.
+references:
+- https://urlhaus.abuse.ch/url/1798923/
+tags:
+  analytic_story:
+  - Remcos
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_pastebin_download/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.005
+  - T1059
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - QueryName
+  - QueryStatus
+  - process_name
+  - QueryResults
+  - Computer
+  security_domain: endpoint
+  impact: 80
+  confidence: 80
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/windows_diskcryptor_usage.yml

@@ -0,0 +1,83 @@
+name: Windows DiskCryptor Usage
+id: d56fe0c8-4650-11ec-a8fa-acde48001122
+version: 1
+date: '2021-11-15'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies DiskCryptor  process name of dcrypt.exe
+  or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt
+  disks manually during an operation. In addition, during install, a dcrypt.sys driver
+  is installed and requires a reboot in order to take effect. There are no command-line
+  arguments used.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe"
+  OR Processes.original_file_name=dcinst.exe) by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: It is possible false positives may be present based on the
+  internal name dcinst.exe, filter as needed. It may be worthy to alert on the service
+  name.
+references:
+- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
+- https://github.com/DavidXanatos/DiskCryptor
+tags:
+  analytic_story:
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1486
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 50
+  risk_score: 35
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to encrypt disks.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_installutil_credential_theft.yml

@@ -0,0 +1,91 @@
+name: Windows InstallUtil Credential Theft
+id: ccfeddec-43ec-11ec-b494-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the Windows InstallUtil.exe binary
+  loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code
+  to bypassing application control and capture credentials by utilizing a tool like
+  MimiKatz. \
+
+  When `InstallUtil.exe` is used in a malicous manner, the path to an executable on
+  the filesystem is typically specified. Take note of the parent process. In a suspicious
+  instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe`
+  or `Explorer.exe`. \
+
+  If used by a developer, typically this will be found with multiple command-line
+  switches/arguments and spawn from Visual Studio. \
+
+  During triage review resulting network connections, file modifications, and parallel
+  processes. Capture any artifacts and review further.'
+search: '`sysmon` EventCode=7  process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll",
+  "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime
+  by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer
+  as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_installutil_credential_theft_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and module loads from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: Typically this will not trigger as by it's very nature InstallUtil
+  does not need credentials. Filter as needed.
+references:
+- https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1218.004
+  - T1218
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially
+    capture credentials in memory.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_installutil_remote_network_connection.yml

@@ -0,0 +1,99 @@
+name: Windows InstallUtil Remote Network Connection
+id: 4fbf9270-43da-11ec-9486-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the Windows InstallUtil.exe binary
+  making a remote network connection. This technique may be used to download and execute
+  code while bypassing application control. \
+
+  When `InstallUtil.exe` is used in a malicous manner, the path to an executable on
+  the filesystem is typically specified. Take note of the parent process. In a suspicious
+  instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe`
+  or `Explorer.exe`. \
+
+  If used by a developer, typically this will be found with multiple command-line
+  switches/arguments and spawn from Visual Studio. \
+
+  During triage review resulting network connections, file modifications, and parallel
+  processes. Capture any artifacts and review further.'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_installutil` by _time span=1h  Processes.process_guid Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | join  process_guid [ | tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid
+  Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename  dest as connection_to_CNC]
+  | table _time dest parent_process_name process_name process_path process process_guid
+  connection_to_CNC dest_port | `windows_installutil_remote_network_connection_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.
+  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
+  TA for the endpoint product.
+known_false_positives: Limited false positives should be present as InstallUtil is
+  not typically used to download remote files. Filter as needed based on Developers
+  requirements.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1218.004
+  - T1218
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Ports.process_guid
+  - Ports.dest
+  - Ports.dest_port
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ generating a remote download.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_installutil_uninstall_option.yml

@@ -0,0 +1,98 @@
+name: Windows InstallUtil Uninstall Option
+id: cfa7b9ac-43f0-11ec-9b48-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the Windows InstallUtil.exe binary.
+  This will execute code while bypassing application control using the `/u` (uninstall)
+  switch. \
+
+  InstallUtil uses the functions install and uninstall within the System.Configuration.Install
+  namespace to process .net assembly. Install function requires admin privileges,
+  however, uninstall function can be run as an unprivileged user.\
+
+  When `InstallUtil.exe` is used in a malicous manner, the path to an executable on
+  the filesystem is typically specified. Take note of the parent process. In a suspicious
+  instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe`
+  or `Explorer.exe`. \
+
+  If used by a developer, typically this will be found with multiple command-line
+  switches/arguments and spawn from Visual Studio. \
+
+  During triage review resulting network connections, file modifications, and parallel
+  processes. Capture any artifacts and review further.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process
+  IN ("*/u*", "*uninstall*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_installutil_uninstall_option_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives should be present. Filter as needed
+  by parent process or application.
+references:
+- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
+- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1218.004
+  - T1218
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ performing an uninstall.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_installutil_uninstall_option_with_network.yml

@@ -0,0 +1,106 @@
+name: Windows InstallUtil Uninstall Option with Network
+id: 1a52c836-43ef-11ec-a36c-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the Windows InstallUtil.exe binary
+  making a remote network connection. This technique may be used to download and execute
+  code while bypassing application control using the `/u` (uninstall) switch. \
+
+  InstallUtil uses the functions install and uninstall within the System.Configuration.Install
+  namespace to process .net assembly. Install function requires admin privileges,
+  however, uninstall function can be run as an unprivileged user.\
+
+  When `InstallUtil.exe` is used in a malicous manner, the path to an executable on
+  the filesystem is typically specified. Take note of the parent process. In a suspicious
+  instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe`
+  or `Explorer.exe`. \
+
+  If used by a developer, typically this will be found with multiple command-line
+  switches/arguments and spawn from Visual Studio. \
+
+  During triage review resulting network connections, file modifications, and parallel
+  processes. Capture any artifacts and review further.'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time
+  span=1h  Processes.process_guid Processes.process_name Processes.dest Processes.process_path
+  Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join  process_guid
+  [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports
+  where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
+  | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
+  original_file_name process_path process process_guid connection_to_CNC dest_port
+  | `windows_installutil_uninstall_option_with_network_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.
+  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
+  TA for the endpoint product.
+known_false_positives: Limited false positives should be present as InstallUtil is
+  not typically used to download remote files. Filter as needed based on Developers
+  requirements.
+references:
+- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
+- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1218.004
+  - T1218
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Ports.process_guid
+  - Ports.dest
+  - Ports.dest_port
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ performing an uninstall.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_installutil_url_in_command_line.yml

@@ -0,0 +1,94 @@
+name: Windows InstallUtil URL in Command Line
+id: 28e06670-43df-11ec-a569-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the Windows InstallUtil.exe binary
+  passing a HTTP request on the command-line. This technique may be used to download
+  and execute code while bypassing application control. \
+
+  When `InstallUtil.exe` is used in a malicous manner, the path to an executable on
+  the filesystem is typically specified. Take note of the parent process. In a suspicious
+  instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe`
+  or `Explorer.exe`. \
+
+  If used by a developer, typically this will be found with multiple command-line
+  switches/arguments and spawn from Visual Studio. \
+
+  During triage review resulting network connections, file modifications, and parallel
+  processes. Capture any artifacts and review further.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process
+  IN ("*http://*","*https://*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_installutil_url_in_command_line_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives should be present as InstallUtil is
+  not typically used to download remote files. Filter as needed based on Developers
+  requirements.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+- https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1218.004
+  - T1218
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ passing a URL on the command-line.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/wmic_xsl_execution_via_url.yml

@@ -0,0 +1,86 @@
+name: WMIC XSL Execution via URL
+id: 787e9dd0-4328-11ec-a029-acde48001122
+version: 1
+date: '2021-11-11'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible
+  Stylesheet Language) script. This originally was identified by Casey Smith, dubbed
+  Squiblytwo, as an application control bypass. Many adversaries will utilize this
+  technique to invoke JScript or VBScript within an XSL file. This technique can also
+  execute local/remote scripts and, similar to its Regsvr32 "Squiblydoo" counterpart,
+  leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows
+  Management Instrumentation provided they utilize the /FORMAT switch. Upon identifying
+  a suspicious execution, review for confirmed network connnection and script download.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process
+  IN ("*http://*", "*https://*") Processes.process="*/format:*" by Processes.parent_process_name
+  Processes.original_file_name Processes.parent_process Processes.process_name Processes.process_id
+  Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives are limited as legitimate applications typically
+  do not download files or xsl using WMIC. Filter as needed.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md
+- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file
+tags:
+  analytic_story:
+  - Suspicious WMI Use
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1220
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/xsl_script_execution_with_wmic.yml

@@ -12,7 +12,7 @@ description: This search is to detect a suspicious wmic.exe process or renamed w
   This TTP is really a good indicator for you to hunt further for FIN7 or other attacker
   that known to used this technique.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*os get*"
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process = "*os get*"
   Processes.process="*/format:*" Processes.process = "*.xsl*" by Processes.parent_process_name
   Processes.parent_process Processes.process_name Processes.process_id Processes.process
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
@@ -25,32 +25,42 @@ known_false_positives: unknown
 references:
 - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
 - https://attack.mitre.org/groups/G0046/
+- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file
 tags:
   analytic_story:
   - FIN7
+  - Suspicious WMI Use
   automated_detection_testing: passed
   confidence: 70
   context:
   - Source:Endpoint
-  - Stage:Execution
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Process name $process_name$ with commandline $process$ to execute jscript
-    in $dest$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script.
   mitre_attack_id:
   - T1220
   observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
   - name: user
     type: User
     role:
     - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/experimental/endpoint/exchange_powershell_module_usage.yml

@@ -33,6 +33,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
 - https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
 - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
 tags:
   analytic_story:
   - ProxyShell

dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml

@@ -41,7 +41,7 @@ tags:
   - Stage:Command And Control
   - Consequence:Loss Of Control
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
   impact: 80
   kill_chain_phases:
   - Actions on Objectives

dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml

@@ -47,7 +47,7 @@ tags:
   - Stage:Credential Access
   - Consequence:Loss Of Control
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
   impact: 80
   kill_chain_phases:
   - Actions on Objectives

dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml

@@ -40,7 +40,7 @@ tags:
   - Stage:Credential Access
   - Consequence:Loss Of Control
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log
   impact: 80
   kill_chain_phases:
   - Actions on Objectives

dist/ssa/detections/setting_credentials_via_powersploit_modules.yml

@@ -40,7 +40,7 @@ tags:
   - Stage:Credential Access
   - Consequence:Loss Of Control
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log
   impact: 90
   kill_chain_phases:
   - Actions on Objectives

docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md

@@ -102,7 +102,7 @@ None identified.
 Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
 Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
 
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log)
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log)
 
 
 

docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md

@@ -99,7 +99,7 @@ None identified.
 Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
 Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
 
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log)
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log)
 
 
 

docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md

@@ -99,7 +99,7 @@ None identified.
 Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
 Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
 
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log)
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log)
 
 
 

docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md

@@ -95,7 +95,7 @@ None identified.
 Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
 Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
 
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log)
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log)
 
 
 

docs/detections.wiki

@@ -31508,7 +31508,7 @@ None identified.
 
 ====Test Dataset====
 
-* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
 
 
 ''version'': 1
@@ -46990,7 +46990,7 @@ None identified.
 
 ====Test Dataset====
 
-* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
 
 
 ''version'': 1
@@ -47077,7 +47077,7 @@ None identified.
 
 ====Test Dataset====
 
-* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log
 
 
 ''version'': 1
@@ -47164,7 +47164,7 @@ None identified.
 
 ====Test Dataset====
 
-* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log
 
 
 ''version'': 1

lookups/attacker_tools.csv

@@ -23,4 +23,5 @@ Massscan_GUI.exe,This executable was delivered in the XMRig Crypto Miner
 KPortScan3.exe,This executable was delivered in the XMRig Crypto Miner and is commonly used by attackers to scan the internet
 NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits
 ns.exe,A commonly used tool used by attackers to scan and map file shares
-SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
+SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
+kportscan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking Forums, to perform network scanning on the internal networks.

macros/process_csc.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=csc.exe OR Processes.original_file_name=csc.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_csc

macros/process_installutil.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_installutil

macros/process_route.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=route.exe OR Processes.original_file_name=route.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_route

macros/process_runas.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=runas.exe OR Processes.original_file_name=runas.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_runas

stories/signed_binary_proxy_execution_installutil.yml

@@ -0,0 +1,28 @@
+name: Signed Binary Proxy Execution InstallUtil
+id: 9482a314-43dc-11ec-a3c9-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility.
+narrative: 'InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. InstallUtil is digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe. \
+
+  There are multiple ways to instantiate InstallUtil and they are all outlined within Atomic Red Team - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md. Two specific ways may be used and that includes invoking via  installer assembly class constructor through .NET and via InstallUtil.exe. \
+
+  Typically, adversaries will utilize the most commonly found way to invoke via InstallUtil Uninstall method. \
+
+  Note that parallel processes, and parent process, play a role in how InstallUtil is being used. In particular, a developer using InstallUtil will spawn from VisualStudio. Adversaries, will spawn from non-standard processes like Explorer.exe, cmd.exe or PowerShell.exe. It''s important to review the command-line to identify the DLL being loaded. \
+
+  Parallel processes may also include csc.exe being used to compile a local `.cs` file. This file will be the input to the output. Developers usually do not build direct on the command shell, therefore this should raise suspicion.'
+references:
+- https://attack.mitre.org/techniques/T1218/004/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/csc_net_on_the_fly_compilation.test.yml

@@ -0,0 +1,12 @@
+name: CSC Net On The Fly Compilation Unit Test
+tests:
+- name: CSC Net On The Fly Compilation
+  file: endpoint/csc_net_on_the_fly_compilation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/firewall_allowed_program_enable.test.yml

@@ -0,0 +1,12 @@
+name: Firewall Allowed Program Enable Unit Test
+tests:
+- name: Firewall Allowed Program Enable
+  file: endpoint/firewall_allowed_program_enable.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml

@@ -0,0 +1,12 @@
+name: High Frequency Copy Of Files In Network Share Unit Test
+tests:
+- name: High Frequency Copy Of Files In Network Share
+  file: endpoint/high_frequency_copy_of_files_in_network_share.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/high_copy_files_in_net_share/security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog

tests/endpoint/loading_of_dynwrapx_module.test.yml

@@ -0,0 +1,12 @@
+name: Loading Of Dynwrapx Module Unit Test
+tests:
+- name: Loading Of Dynwrapx Module
+  file: endpoint/loading_of_dynwrapx_module.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_dynwraper.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/network_discovery_using_route_windows_app.test.yml

@@ -0,0 +1,12 @@
+name: Network Discovery Using Route Windows App Unit Test
+tests:
+- name: Network Discovery Using Route Windows App
+  file: endpoint/network_discovery_using_route_windows_app.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: WinEventLog

tests/endpoint/runas_execution_in_commandline.test.yml

@@ -0,0 +1,12 @@
+name: Runas Execution in CommandLine Unit Test
+tests:
+- name: Runas Execution in CommandLine
+  file: endpoint/runas_execution_in_commandline.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml

@@ -6,5 +6,5 @@ tests:
     description: Test enabling or disabling of accounts detections
     attack_data:
       - file_name: logAllDSInternalsModules.log
-        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
         source: WinEventLog:Security

tests/endpoint/suspicious_process_dns_query_known_abuse_web_services.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious Process DNS Query Known Abuse Web Services Unit Test
+tests:
+- name: Suspicious Process DNS Query Known Abuse Web Services
+  file: endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_pastebin_download/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_diskcryptor_usage.test.yml

@@ -0,0 +1,12 @@
+name: Windows DiskCryptor Usage Unit Test
+tests:
+- name: Windows DiskCryptor Usage
+  file: endpoint/windows_diskcryptor_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_installutil_credential_theft.test.yml

@@ -0,0 +1,12 @@
+name: Windows InstallUtil Credential Theft Unit Test
+tests:
+- name: Windows InstallUtil Credential Theft
+  file: endpoint/windows_installutil_credential_theft.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_installutil_remote_network_connection.test.yml

@@ -0,0 +1,12 @@
+name: Windows InstallUtil Remote Network Connection Unit Test
+tests:
+- name: Windows InstallUtil Remote Network Connection
+  file: endpoint/windows_installutil_remote_network_connection.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_installutil_uninstall_option.test.yml

@@ -0,0 +1,12 @@
+name: Windows InstallUtil Uninstall Option Unit Test
+tests:
+- name: Windows InstallUtil Uninstall Option
+  file: endpoint/windows_installutil_uninstall_option.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_installutil_uninstall_option_with_network.test.yml

@@ -0,0 +1,12 @@
+name: Windows InstallUtil Uninstall Option with Network Unit Test
+tests:
+- name: Windows InstallUtil Uninstall Option with Network
+  file: endpoint/windows_installutil_uninstall_option_with_network.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_installutil_url_in_command_line.test.yml

@@ -0,0 +1,12 @@
+name: Windows InstallUtil URL in Command Line Unit Test
+tests:
+- name: Windows InstallUtil URL in Command Line
+  file: endpoint/windows_installutil_url_in_command_line.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/wmic_xsl_execution_via_url.test.yml

@@ -0,0 +1,12 @@
+name: WMIC XSL Execution via URL Unit Test
+tests:
+- name: WMIC XSL Execution via URL
+  file: endpoint/wmic_xsl_execution_via_url.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog