Merge pull request #1945 from splunk/whisper

WhisperTangoFoxtrot

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -1,7 +1,7 @@
 name: CMD Carry Out String Command Parameter
 id: 54a6ed00-3256-11ec-b031-acde48001122
-version: 2
-date: '2021-12-13'
+version: 3
+date: '2022-01-18'
 author: Teoderick Contreras, Bhavin Patel, Splunk
 type: Hunting
 datamodel:
@@ -27,10 +27,12 @@ known_false_positives: False positives may be high based on legitimate scripted
   in any environment. Filter as needed.
 references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - IcedID
   - Log4Shell CVE-2021-44228
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/impacket_lateral_movement_commandline_parameters.yml

@@ -1,7 +1,7 @@
 name: Impacket Lateral Movement Commandline Parameters
 id: 8ce07472-496f-11ec-ab3b-3e22fbd008af
-version: 1
-date: '2021-11-19'
+version: 2
+date: '2022-01-18'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
@@ -34,9 +34,11 @@ references:
 - https://attack.mitre.org/techniques/T1053/005
 - https://github.com/SecureAuthCorp/impacket
 - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -1,7 +1,7 @@
 name: Malicious PowerShell Process - Encoded Command
 id: c4db14d9-7909-48b4-a054-aa14d89dbb19
-version: 6
-date: '2021-10-05'
+version: 7
+date: '2022-01-18'
 author: David Dorsey, Michael Haag, Splunk
 type: Hunting
 datamodel:
@@ -37,10 +37,12 @@ references:
 - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
 - https://ss64.com/ps/powershell.html
 - https://twitter.com/M_haggis/status/1440758396534214658?s=20
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Malicious PowerShell
   - NOBELIUM Group
+  - WhisperGate
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml

@@ -1,7 +1,7 @@
 name: Suspicious Process DNS Query Known Abuse Web Services
 id: 3cf0dc36-484d-11ec-a6bc-acde48001122
-version: 1
-date: '2021-11-18'
+version: 2
+date: '2022-01-18'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -25,9 +25,11 @@ known_false_positives: Noise and false positive can be seen if the following ins
   needed.
 references:
 - https://urlhaus.abuse.ch/url/1798923/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Remcos
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 80
   context:

detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml

@@ -0,0 +1,84 @@
+name: Windows DotNet Binary in Non Standard Path
+id: fddf3b56-7933-11ec-98a6-acde48001122
+version: 1
+date: '2022-01-19'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies native .net binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory. The analytic identifies the .net binary by using a lookup and compares the process name and original file name (internal name).
+  The analytic utilizes a lookup with the is_net_windows_file macro to identify the binary process name and original file name. if one or the other matches an alert will be generated.
+  Adversaries abuse these binaries as they are native to windows and native DotNet. Note that not all SDK (post install of Windows) are captured in the lookup.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `is_net_windows_file`
+  | `windows_dotnet_binary_in_non_standard_path_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
+  - https://attack.mitre.org/techniques/T1036/003/
+  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Masquerading - Rename System Utilities
+  - Unusual Processes
+  - Ransomware
+  - Signed Binary Proxy Execution InstallUtil
+  - WhisperGate
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1036
+  - T1036.003
+  - T1218
+  - T1218.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log
+  automated_detection_testing: passed

detections/endpoint/windows_installutil_in_non_standard_path.yml

@@ -0,0 +1,81 @@
+name: Windows InstallUtil in Non Standard Path
+id: dcf74b22-7933-11ec-857c-acde48001122
+version: 1
+date: '2022-01-19'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the Windows binary InstallUtil.exe running from a non-standard location. The analytic utilizes a macro for InstallUtil and identifies both the process_name and original_file_name.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_installutil` NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash 
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_installutil_in_non_standard_path_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
+  - https://attack.mitre.org/techniques/T1036/003/
+  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Masquerading - Rename System Utilities
+  - Unusual Processes
+  - Ransomware
+  - Signed Binary Proxy Execution InstallUtil
+  - WhisperGate
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1036
+  - T1036.003
+  - T1218
+  - T1218.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log
+  automated_detection_testing: passed

detections/endpoint/windows_nirsoft_advancedrun.yml

@@ -0,0 +1,77 @@
+name: Windows NirSoft AdvancedRun
+id: bb4f3090-7ae4-11ec-897f-acde48001122
+version: 1
+date: '2022-01-21'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe has similar capabilities as other remote programs like psexec. AdvancedRun may also ingest a configuration file with all settings defined and perform its activity. 
+  The analytic is written in a way to identify a renamed binary and also the common command-line arguments.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=advancedrun.exe OR Processes.original_file_name=advancedrun.exe)
+  Processes.process IN ("*EXEFilename*","*/cfg*","*RunAs*", "*WindowState*") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `windows_nirsoft_advancedrun_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives should be limited as it is specific to AdvancedRun. Filter as needed based on legitimate usage.
+references:
+  - http://www.nirsoft.net/utils/advanced_run.html
+  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+tags:
+  analytic_story:
+  - Unusual Processes
+  - Ransomware
+  - WhisperGate
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1588.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 60
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 60
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/windows_nirsoft_utilities.yml

@@ -0,0 +1,74 @@
+name: Windows NirSoft Utilities
+id: 5b2f4596-7d4c-11ec-88a7-acde48001122
+version: 1
+date: '2022-01-24'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic assists with identifying the proces execution of commonly used utilities from NirSoft. Potentially not adversary behavior, but worth identifying to know if the software is present and being used.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `is_nirsoft_software`
+  | `windows_nirsoft_utilities_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present. Filtering may be required before setting to alert.
+references:
+  - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A
+  - http://www.nirsoft.net/
+  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+tags:
+  analytic_story:
+  - WhisperGate
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1588.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to NiRSoft software usage.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

lookups/is_net_windows_file.csv

@@ -0,0 +1,47 @@
+filename,originalFileName,netFile
+MSBuild.exe,MSBuild.exe,True
+ComSvcConfig.exe,ComSvcConfig.exe,True
+DfsrAdmin.exe,DfsrAdmin.exe,True
+dfsvc.exe,dfsvc.exe,True
+Microsoft.Workflow.Compiler.exe,Microsoft.Workflow.Compiler.exe,True
+SMSvcHost.exe,SMSvcHost.exe,True
+WsatConfig.exe,WsatConfig.exe,True
+AddInProcess.exe,AddInProcess.exe,True
+AddInProcess32.exe,AddInProcess32.exe,True
+AddInUtil.exe,AddInUtil.exe,True
+aspnet_compiler.exe,aspnet_compiler.exe,True
+aspnet_regbrowsers.exe,aspnet_regbrowsers.exe,True
+aspnet_regsql.exe,aspnet_regsql.exe,True
+CasPol.exe,CasPol.exe,True
+DataSvcUtil.exe,DataSvcUtil.exe,True
+EdmGen.exe,EdmGen.exe,True
+InstallUtil.exe,InstallUtil.exe,True
+jsc.exe,jsc.exe,True
+ngentask.exe,ngentask.exe,True
+ngen.exe,ngen.exe,True
+RegAsm.exe,RegAsm.exe,True
+RegSvcs.exe,RegSvcs.exe,True
+SDNBR.exe,SDNBR.exe,True
+acu.exe,acu.exe,True
+AppVStreamingUX.exe,,True
+dsac.exe,dsac.exe,True
+LbfoAdmin.exe,LBFOADMIN.EXE,True
+Microsoft.Uev.SyncController.exe,Microsoft.Uev.SyncController.exe,True
+mtedit.exe,mtedit.exe,True
+ScriptRunner.exe,ScriptRunner.exe,True
+ServerManager.exe,servermanager.dll,True
+stordiag.exe,stordiag.exe,True
+storeadm.exe,storeadm.exe,True
+tzsync.exe,tzsync.exe,True
+UevAgentPolicyGenerator.exe,UevAgentPolicyGenerator.exe,True
+UevAppMonitor.exe,UevAppMonitor.exe,True
+UevTemplateBaselineGenerator.exe,UevTemplateBaselineGenerator.exe,True
+UevTemplateConfigItemGenerator.exe,UevTemplateConfigItemGenerator.exe,True
+powershell_ise.exe,powershell_ise.EXE,True
+iediagcmd.exe,IEDiagCmd.exe,True
+XBox.TCUI.exe,XBox.TCUI.exe,True
+Microsoft.ActiveDirectory.WebServices.exe,Microsoft.ActiveDirectory.WebServices.exe,True
+iisual.exe,iisual.exe,True
+FileHistory.exe,FileHistory.exe,True
+SecureAssessmentBrowser.exe,SecureAssessmentBrowser.exe,True
+aspnet_regiis.exe,aspnet_regiis.exe,True

lookups/is_net_windows_file.yml

@@ -0,0 +1,6 @@
+default_match: 'false'
+description: A full baseline of executable files in \Windows\, including sub-directories from Server 2016 and Windows 11. Certain .net binaries may not have been captured due to different Windows SDK's or developer utilities not installed during baseline.
+filename: is_net_windows_file.csv
+min_matches: 1
+name: is_net_windows_file
+case_sensitive_match: 'false'

lookups/is_nirsoft_software.csv

@@ -0,0 +1,15 @@
+filename,nirsoftFile
+AdvancedRun.exe,True
+ChromePass.exe,True
+CredHistView.exe,True
+Dialupass.exe,True
+iepv.exe,True
+LostMyPassword.exe,True
+mailpv.exe,True
+mspass.exe,True
+netpass.exe,True
+PasswordFox.exe,True
+PasswordHashesView.exe,True
+PstPassword.exe,True
+RegHiveBackup.exe,True
+WebBrowserPassView.exe,True

lookups/is_nirsoft_software.yml

@@ -0,0 +1,6 @@
+default_match: 'false'
+description: A subset of utilities provided by NirSoft that may be used by adversaries.
+filename: is_nirsoft_software.csv
+min_matches: 1
+name: is_nirsoft_software
+case_sensitive_match: 'false'

lookups/is_windows_system_file.yml

@@ -3,3 +3,4 @@ description: A full baseline of executable files in Windows\System32 and Windows
 filename: is_windows_system_file.csv
 min_matches: 1
 name: is_windows_system_file
+case_sensitive_match: 'false'

macros/is_net_windows_file.yml

@@ -0,0 +1,3 @@
+definition: lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true
+description: This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11.
+name: is_net_windows_file

macros/is_nirsoft_software.yml

@@ -0,0 +1,3 @@
+definition: lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true
+description: This macro is related to potentially identifiable software related to NirSoft. Remove or filter as needed based.
+name: is_nirsoft_software

tests/endpoint/windows_dotnet_binary_in_non_standard_path.test.yml

@@ -0,0 +1,12 @@
+name: Windows DotNet Binary in Non Standard Path Unit Test
+tests:
+- name: Windows DotNet Binary in Non Standard Path
+  file: endpoint/windows_dotnet_binary_in_non_standard_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_installutil_path.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_installutil_in_non_standard_path.test.yml

@@ -0,0 +1,12 @@
+name: Windows InstallUtil in Non Standard Path Unit Test
+tests:
+- name: Windows InstallUtil in Non Standard Path
+  file: endpoint/windows_installutil_in_non_standard_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_installutil_path.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_nirsoft_advancedrun.test.yml

@@ -0,0 +1,12 @@
+name: Windows NirSoft AdvancedRun Unit Test
+tests:
+- name: Windows NirSoft AdvancedRun
+  file: endpoint/windows_nirsoft_advancedrun.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_nirsoft_utilities.test.yml

@@ -0,0 +1,12 @@
+name: Windows NirSoft Utilities Unit Test
+tests:
+- name: Windows NirSoft Utilities
+  file: endpoint/windows_nirsoft_utilities.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog