Branch was auto-updated.

detections/endpoint/csc_net_on_the_fly_compilation.yml

@@ -0,0 +1,72 @@
+name: CSC Net On The Fly Compilation
+id: ea73128a-43ab-11ec-9753-acde48001122
+version: 1
+date: '2021-11-12'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: this analytic is to detect a suspicious compile before delivery approach
+  of .net compiler csc.exe. This technique was seen in several adversaries, malware
+  and even in red teams to take advantage the csc.exe .net compiler tool to compile
+  on the fly a malicious .net code to evade detection from security product. This
+  is a good hunting query to check further the file or process created after this
+  event and check the file path that passed to csc.exe which is the .net code. Aside
+  from that, powershell is capable of using this compiler in executing .net code in
+  a powershell script so filter on that case is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_csc` Processes.process
+  = "*/noconfig*" Processes.process = "*/fullpaths*" Processes.process = "*@*" by
+  Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `csc_net_on_the_fly_compilation_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: A network operator or systems administrator may utilize an
+  automated powershell script taht execute .net code that may generate false positive.
+  filter is needed.
+references:
+- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/
+- https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1027.004
+  - T1027
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: csc.exe with commandline $process$ to compile .net code on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/firewall_allowed_program_enable.yml

@@ -0,0 +1,69 @@
+name: Firewall Allowed Program Enable
+id: 9a8f63a8-43ac-11ec-904c-acde48001122
+version: 1
+date: '2021-11-12'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic detects a potential suspicious modification of firewall
+  rule allowing to execute specific application. This technique was identified when
+  an adversary and red teams to bypassed firewall file execution restriction in a
+  targetted host. Take note that this event or command can run by administrator during
+  testing or allowing legitimate tool or application.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*"
+  Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process
+  = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `firewall_allowed_program_enable_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: A network operator or systems administrator may utilize an
+  automated or manual execution of this firewall rule that may generate false positives.
+  Filter as needed.
+references:
+- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1562.004
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: firewall allowed program commandline $process$ of $process_name$ on $dest$
+    by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/high_frequency_copy_of_files_in_network_share.yml

@@ -0,0 +1,69 @@
+name: High Frequency Copy Of Files In Network Share
+id: 40925f12-4709-11ec-bb43-acde48001122
+version: 1
+date: '2021-11-16'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious high frequency copying/moving
+  of files in network share as part of information sabotage. This anomaly event can
+  be a good indicator of insider trying to sabotage data by transfering classified
+  or internal files within network share to exfitrate it after or to lure evidence
+  of insider attack to other user. This behavior may catch several noise if network
+  share is a common place for classified or internal document processing.
+search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key")
+  Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
+  "0x2" |  bucket _time span=5m | stats values(Relative_Target_Name) as valRelativeTargetName,
+  values(Share_Name) as valShareName, values(Object_Type) as valObjectType, values(Access_Mask)
+  as valAccessmask, values(src_port) as valSrcPort, values(Source_Address) as valSrcAddress
+  count as numShareName by dest, _time, EventCode, user | eventstats avg(numShareName)
+  as avgShareName, stdev(numShareName) as stdShareName, count as numSlots by dest,
+  _time, EventCode, user |  eval upperThreshold=(avgShareName + stdShareName *3) |  eval
+  isOutlier=if(avgShareName > 20 and avgShareName >= upperThreshold, 1, 0) |  search
+  isOutlier=1 | `high_frequency_copy_of_files_in_network_share_filter`'
+how_to_implement: o successfully implement this search, you need to be ingesting Windows
+  Security Event Logs with 5145 EventCode enabled. The Windows TA is also required.
+  Also enable the object Audit access success/failure in your group policy.
+known_false_positives: this behavior may seen in normal transfer of file within network
+  if network share is common place for sharing documents.
+references:
+- https://attack.mitre.org/techniques/T1537/
+tags:
+  analytic_story:
+  - Information Sabotage
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/high_copy_files_in_net_share/security.log
+  kill_chain_phases:
+  - Exfiltration
+  mitre_attack_id:
+  - T1537
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Share_Name
+  - Relative_Target_Name
+  - Object_Type
+  - Access_Mask
+  - user
+  - src_port
+  - Source_Address
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  message: high frequency copy of document in network share $Share_Name$ from $Source_Address$
+    by $user$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/loading_of_dynwrapx_module.yml

@@ -0,0 +1,74 @@
+name: Loading Of Dynwrapx Module
+id: eac5e8ba-4857-11ec-9371-acde48001122
+version: 1
+date: '2021-11-18'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: DynamicWrapperX is an ActiveX component that can be used in a script
+  to call Windows API functions, but it requires the dynwrapx.dll to be installed
+  and registered. With that, registering or loading dynwrapx.dll to a host highly
+  suspect. Why is it needed? In most malicious instances, During triage, review parallel
+  processes and pivot on the process_guid. Review the registry for any suspicious
+  modifications meant to load dynwrapx.dll. Identify any suspicious module loads of
+  dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript.
+search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName
+  = "dynwrapx.dll" OR  Product = "DynamicWrapperX") | stats count min(_time) as firstTime
+  max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name
+  Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `loading_of_dynwrapx_module_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
+  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
+  latest TA for the endpoint product.
+known_false_positives: False positives should be limited, however it is possible to
+  filter by Processes.process_name and specific processes (ex. wscript.exe). Filter
+  as needed. This may need modification based on EDR telemetry and how it brings in
+  registry data. For example, removal of (Default).
+references:
+- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
+- https://www.script-coding.com/dynwrapx_eng.html
+- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
+- https://tria.ge/210929-ap75vsddan
+- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
+tags:
+  analytic_story:
+  - Remcos
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  - T1055.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - OriginalFileName
+  - Product
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: dynwrapx.dll loaded by process $process_name$ on $Computer$
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/network_discovery_using_route_windows_app.yml

@@ -0,0 +1,66 @@
+name: Network Discovery Using Route Windows App
+id: dd83407e-439f-11ec-ab8e-acde48001122
+version: 1
+date: '2021-11-12'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic look for a spawned process of route.exe windows application.
+  Adversaries and red teams alike abuse this application the recon or do a network
+  discovery on a target host. but one possible false positive might be an automated
+  tool used by a system administator or a powershell script in amazon ec2 config services.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_route` by Processes.dest
+  Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_discovery_using_route_windows_app_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: A network operator or systems administrator may utilize an
+  automated host discovery application that may generate false positives or an amazon
+  ec2 script that uses this application. Filter as needed.
+references:
+- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1016
+  - T1016.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Network Connection discovery on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/runas_execution_in_commandline.yml

@@ -0,0 +1,68 @@
+name: Runas Execution in CommandLine
+id: 4807e716-43a4-11ec-a0e7-acde48001122
+version: 1
+date: '2021-11-12'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic look for a spawned runas.exe process with a administrator
+  user option parameter. This parameter was abused by adversaries, malware author
+  or even red teams to gain elevated privileges in target host. This is a good hunting
+  query to figure out privilege escalation tactics that may used for different stages
+  like lateral movement but take note that administrator may use this command in purpose
+  so its better to see other event context before and after this analytic.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_runas` AND Processes.process
+  = "*/user:*" AND Processes.process = "*admin*" by Processes.dest Processes.user
+  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `runas_execution_in_commandline_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: A network operator or systems administrator may utilize an
+  automated or manual execute this command that may generate false positives. filter
+  is needed.
+references:
+- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#
+tags:
+  analytic_story:
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1134
+  - T1134.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - stage:Privilege Escalation
+  message: elevated process using runas on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml

@@ -0,0 +1,68 @@
+name: Suspicious Process DNS Query Known Abuse Web Services
+id: 3cf0dc36-484d-11ec-a6bc-acde48001122
+version: 1
+date: '2021-11-18'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious process having a dns query on
+  known abuse text paste web services, or VoIP, instant messaging and digital distribution
+  platform to download some files. This technique is abused by adversaries, malware
+  attacker and red team to download a malicious file on the target host. This is a
+  good TTP indicator for possible initial access technique. Noise and false positive
+  can be seen if the following instant messaging is allowed or common application
+  in corporate network.
+search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*",
+  "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe",
+  "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image
+  QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`'
+how_to_implement: his detection relies on sysmon logs with the Event ID 7, Driver
+  loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll
+  is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query.
+  We suggest to run this detection at least once a day over the last 14 days.
+known_false_positives: Noise and false positive can be seen if the following instant
+  messaging is allowed to use within corporate network. filter is needed.
+references:
+- https://urlhaus.abuse.ch/url/1798923/
+tags:
+  analytic_story:
+  - Remcos
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_pastebin_download/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.005
+  - T1059
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - QueryName
+  - QueryStatus
+  - process_name
+  - QueryResults
+  - Computer
+  security_domain: endpoint
+  impact: 80
+  confidence: 80
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

macros/process_csc.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=csc.exe OR Processes.original_file_name=csc.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_csc

macros/process_route.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=route.exe OR Processes.original_file_name=route.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_route

macros/process_runas.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=runas.exe OR Processes.original_file_name=runas.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_runas

tests/endpoint/csc_net_on_the_fly_compilation.test.yml

@@ -0,0 +1,12 @@
+name: CSC Net On The Fly Compilation Unit Test
+tests:
+- name: CSC Net On The Fly Compilation
+  file: endpoint/csc_net_on_the_fly_compilation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/firewall_allowed_program_enable.test.yml

@@ -0,0 +1,12 @@
+name: Firewall Allowed Program Enable Unit Test
+tests:
+- name: Firewall Allowed Program Enable
+  file: endpoint/firewall_allowed_program_enable.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml

@@ -0,0 +1,12 @@
+name: High Frequency Copy Of Files In Network Share Unit Test
+tests:
+- name: High Frequency Copy Of Files In Network Share
+  file: endpoint/high_frequency_copy_of_files_in_network_share.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/high_copy_files_in_net_share/security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog

tests/endpoint/loading_of_dynwrapx_module.test.yml

@@ -0,0 +1,12 @@
+name: Loading Of Dynwrapx Module Unit Test
+tests:
+- name: Loading Of Dynwrapx Module
+  file: endpoint/loading_of_dynwrapx_module.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_dynwraper.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/network_discovery_using_route_windows_app.test.yml

@@ -0,0 +1,12 @@
+name: Network Discovery Using Route Windows App Unit Test
+tests:
+- name: Network Discovery Using Route Windows App
+  file: endpoint/network_discovery_using_route_windows_app.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: WinEventLog

tests/endpoint/runas_execution_in_commandline.test.yml

@@ -0,0 +1,12 @@
+name: Runas Execution in CommandLine Unit Test
+tests:
+- name: Runas Execution in CommandLine
+  file: endpoint/runas_execution_in_commandline.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_process_dns_query_known_abuse_web_services.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious Process DNS Query Known Abuse Web Services Unit Test
+tests:
+- name: Suspicious Process DNS Query Known Abuse Web Services
+  file: endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_pastebin_download/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog