From bbea800499fb44296d4f7f0e5d081566827d3492 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 18 Jan 2022 19:36:58 -0700
Subject: [PATCH 01/11] whisper1

---
 .../impacket_lateral_movement_commandline_parameters.yml     | 5 +++--
 .../malicious_powershell_process___encoded_command.yml       | 5 +++--
 ...suspicious_process_dns_query_known_abuse_web_services.yml | 5 +++--
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
index d2c6c8d24a..c8955cd92b 100644
--- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
@@ -1,7 +1,7 @@
 name: Impacket Lateral Movement Commandline Parameters
 id: 8ce07472-496f-11ec-ab3b-3e22fbd008af
-version: 1
-date: '2021-11-19'
+version: 2
+date: '2022-01-18'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
@@ -34,6 +34,7 @@ references:
 - https://attack.mitre.org/techniques/T1053/005
 - https://github.com/SecureAuthCorp/impacket
 - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index f0ac9f5873..5b6db5ac3f 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -1,7 +1,7 @@
 name: Malicious PowerShell Process - Encoded Command
 id: c4db14d9-7909-48b4-a054-aa14d89dbb19
-version: 6
-date: '2021-10-05'
+version: 7
+date: '2022-01-18'
 author: David Dorsey, Michael Haag, Splunk
 type: Hunting
 datamodel:
@@ -37,6 +37,7 @@ references:
 - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
 - https://ss64.com/ps/powershell.html
 - https://twitter.com/M_haggis/status/1440758396534214658?s=20
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Malicious PowerShell
diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
index 2cd03644c4..a6b92a7f3b 100644
--- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
+++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
@@ -1,7 +1,7 @@
 name: Suspicious Process DNS Query Known Abuse Web Services
 id: 3cf0dc36-484d-11ec-a6bc-acde48001122
-version: 1
-date: '2021-11-18'
+version: 2
+date: '2022-01-18'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -25,6 +25,7 @@ known_false_positives: Noise and false positive can be seen if the following ins
   needed.
 references:
 - https://urlhaus.abuse.ch/url/1798923/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Remcos

From e5dfe45bf733f8fe0dcee3478489e32c2245af57 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 18 Jan 2022 19:40:11 -0700
Subject: [PATCH 02/11] Update cmd_carry_out_string_command_parameter.yml

---
 detections/endpoint/cmd_carry_out_string_command_parameter.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
index 0550aed76a..f9bb7e0783 100644
--- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml
+++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -27,6 +27,7 @@ known_false_positives: False positives may be high based on legitimate scripted
   in any environment. Filter as needed.
 references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - IcedID

From f17abe251fc8b0aa07f3cf16f779cd5b34ed9474 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 18 Jan 2022 19:41:50 -0700
Subject: [PATCH 03/11] Update cmd_carry_out_string_command_parameter.yml

---
 .../endpoint/cmd_carry_out_string_command_parameter.yml       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
index f9bb7e0783..e90c54c6dc 100644
--- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml
+++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -1,7 +1,7 @@
 name: CMD Carry Out String Command Parameter
 id: 54a6ed00-3256-11ec-b031-acde48001122
-version: 2
-date: '2021-12-13'
+version: 3
+date: '2022-01-18'
 author: Teoderick Contreras, Bhavin Patel, Splunk
 type: Hunting
 datamodel:

From 5bfcf2eea3dde85e43fb00bef213314b2b7e6759 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 20 Jan 2022 14:34:04 -0700
Subject: [PATCH 04/11] InstallUtil and DotNet Assemblies

---
 ...ows_dotnet_binary_in_non_standard_path.yml | 81 +++++++++++++++++++
 ...ndows_installutil_in_non_standard_path.yml | 78 ++++++++++++++++++
 lookups/is_net_windows_file.csv               | 47 +++++++++++
 lookups/is_net_windows_file.yml               |  6 ++
 lookups/is_windows_system_file.yml            |  1 +
 macros/is_net_windows_file.yml                |  3 +
 ...otnet_binary_in_non_standard_path.test.yml | 12 +++
 ..._installutil_in_non_standard_path.test.yml | 12 +++
 8 files changed, 240 insertions(+)
 create mode 100644 detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
 create mode 100644 detections/endpoint/windows_installutil_in_non_standard_path.yml
 create mode 100644 lookups/is_net_windows_file.csv
 create mode 100644 lookups/is_net_windows_file.yml
 create mode 100644 macros/is_net_windows_file.yml
 create mode 100644 tests/endpoint/windows_dotnet_binary_in_non_standard_path.test.yml
 create mode 100644 tests/endpoint/windows_installutil_in_non_standard_path.test.yml

diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
new file mode 100644
index 0000000000..c0a3164913
--- /dev/null
+++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
@@ -0,0 +1,81 @@
+name: Windows DotNet Binary in Non Standard Path
+id: fddf3b56-7933-11ec-98a6-acde48001122
+version: 1
+date: '2022-01-19'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies native .net binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory. The analytic identifies the .net binary by using a lookup and compares the process name and original file name (internal name).
+  The analytic utilizes a lookup with the is_net_windows_file macro to identify the binary process name and original file name. if one or the other matches an alert will be generated.
+  Adversaries abuse these binaries as they are native to windows and native DotNet. Note that not all SDK (post install of Windows) are captured in the lookup.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `is_net_windows_file`
+  | `windows_dotnet_binary_in_non_standard_path_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
+  - https://attack.mitre.org/techniques/T1036/003/
+  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Masquerading - Rename System Utilities
+  - Unusual Processes
+  - Ransomware
+  - Signed Binary Proxy Execution InstallUtil
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1036
+  - T1036.003
+  - T1218
+  - T1218.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml
new file mode 100644
index 0000000000..3518093ccb
--- /dev/null
+++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml
@@ -0,0 +1,78 @@
+name: Windows InstallUtil in Non Standard Path
+id: dcf74b22-7933-11ec-857c-acde48001122
+version: 1
+date: '2022-01-19'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the Windows binary InstallUtil.exe running from a non-standard location. The analytic utilizes a macro for InstallUtil and identifies both the process_name and original_file_name.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_installutil` NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash 
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_installutil_in_non_standard_path_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
+  - https://attack.mitre.org/techniques/T1036/003/
+  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Masquerading - Rename System Utilities
+  - Unusual Processes
+  - Ransomware
+  - Signed Binary Proxy Execution InstallUtil
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1036
+  - T1036.003
+  - T1218
+  - T1218.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/lookups/is_net_windows_file.csv b/lookups/is_net_windows_file.csv
new file mode 100644
index 0000000000..4c21dbd007
--- /dev/null
+++ b/lookups/is_net_windows_file.csv
@@ -0,0 +1,47 @@
+filename,originalFileName,netFile
+MSBuild.exe,MSBuild.exe,True
+ComSvcConfig.exe,ComSvcConfig.exe,True
+DfsrAdmin.exe,DfsrAdmin.exe,True
+dfsvc.exe,dfsvc.exe,True
+Microsoft.Workflow.Compiler.exe,Microsoft.Workflow.Compiler.exe,True
+SMSvcHost.exe,SMSvcHost.exe,True
+WsatConfig.exe,WsatConfig.exe,True
+AddInProcess.exe,AddInProcess.exe,True
+AddInProcess32.exe,AddInProcess32.exe,True
+AddInUtil.exe,AddInUtil.exe,True
+aspnet_compiler.exe,aspnet_compiler.exe,True
+aspnet_regbrowsers.exe,aspnet_regbrowsers.exe,True
+aspnet_regsql.exe,aspnet_regsql.exe,True
+CasPol.exe,CasPol.exe,True
+DataSvcUtil.exe,DataSvcUtil.exe,True
+EdmGen.exe,EdmGen.exe,True
+InstallUtil.exe,InstallUtil.exe,True
+jsc.exe,jsc.exe,True
+ngentask.exe,ngentask.exe,True
+ngen.exe,ngen.exe,True
+RegAsm.exe,RegAsm.exe,True
+RegSvcs.exe,RegSvcs.exe,True
+SDNBR.exe,SDNBR.exe,True
+acu.exe,acu.exe,True
+AppVStreamingUX.exe,,True
+dsac.exe,dsac.exe,True
+LbfoAdmin.exe,LBFOADMIN.EXE,True
+Microsoft.Uev.SyncController.exe,Microsoft.Uev.SyncController.exe,True
+mtedit.exe,mtedit.exe,True
+ScriptRunner.exe,ScriptRunner.exe,True
+ServerManager.exe,servermanager.dll,True
+stordiag.exe,stordiag.exe,True
+storeadm.exe,storeadm.exe,True
+tzsync.exe,tzsync.exe,True
+UevAgentPolicyGenerator.exe,UevAgentPolicyGenerator.exe,True
+UevAppMonitor.exe,UevAppMonitor.exe,True
+UevTemplateBaselineGenerator.exe,UevTemplateBaselineGenerator.exe,True
+UevTemplateConfigItemGenerator.exe,UevTemplateConfigItemGenerator.exe,True
+powershell_ise.exe,powershell_ise.EXE,True
+iediagcmd.exe,IEDiagCmd.exe,True
+XBox.TCUI.exe,XBox.TCUI.exe,True
+Microsoft.ActiveDirectory.WebServices.exe,Microsoft.ActiveDirectory.WebServices.exe,True
+iisual.exe,iisual.exe,True
+FileHistory.exe,FileHistory.exe,True
+SecureAssessmentBrowser.exe,SecureAssessmentBrowser.exe,True
+aspnet_regiis.exe,aspnet_regiis.exe,True
\ No newline at end of file
diff --git a/lookups/is_net_windows_file.yml b/lookups/is_net_windows_file.yml
new file mode 100644
index 0000000000..c7cc9e77ef
--- /dev/null
+++ b/lookups/is_net_windows_file.yml
@@ -0,0 +1,6 @@
+default_match: 'false'
+description: A full baseline of executable files in \Windows\, including sub-directories from Server 2016 and Windows 11. Certain .net binaries may not have been captured due to different Windows SDK's or developer utilities not installed during baseline.
+filename: is_net_windows_file.csv
+min_matches: 1
+name: is_net_windows_file
+case_sensitive_match: 'false'
\ No newline at end of file
diff --git a/lookups/is_windows_system_file.yml b/lookups/is_windows_system_file.yml
index d41c0a87dc..934f568bc7 100644
--- a/lookups/is_windows_system_file.yml
+++ b/lookups/is_windows_system_file.yml
@@ -3,3 +3,4 @@ description: A full baseline of executable files in Windows\System32 and Windows
 filename: is_windows_system_file.csv
 min_matches: 1
 name: is_windows_system_file
+case_sensitive_match: 'false'
\ No newline at end of file
diff --git a/macros/is_net_windows_file.yml b/macros/is_net_windows_file.yml
new file mode 100644
index 0000000000..b7061bc6a0
--- /dev/null
+++ b/macros/is_net_windows_file.yml
@@ -0,0 +1,3 @@
+definition: lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true
+description: This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11.
+name: is_net_windows_file
\ No newline at end of file
diff --git a/tests/endpoint/windows_dotnet_binary_in_non_standard_path.test.yml b/tests/endpoint/windows_dotnet_binary_in_non_standard_path.test.yml
new file mode 100644
index 0000000000..13eb9a4236
--- /dev/null
+++ b/tests/endpoint/windows_dotnet_binary_in_non_standard_path.test.yml
@@ -0,0 +1,12 @@
+name: Windows DotNet Binary in Non Standard Path Unit Test
+tests:
+- name: Windows DotNet Binary in Non Standard Path
+  file: endpoint/windows_dotnet_binary_in_non_standard_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_installutil_path.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/windows_installutil_in_non_standard_path.test.yml b/tests/endpoint/windows_installutil_in_non_standard_path.test.yml
new file mode 100644
index 0000000000..aab6dcf46c
--- /dev/null
+++ b/tests/endpoint/windows_installutil_in_non_standard_path.test.yml
@@ -0,0 +1,12 @@
+name: Windows InstallUtil in Non Standard Path Unit Test
+tests:
+- name: Windows InstallUtil in Non Standard Path
+  file: endpoint/windows_installutil_in_non_standard_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_installutil_path.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From c3159a29cb3185d02f746e88352d8b4fc85bc20d Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 24 Jan 2022 07:25:06 -0700
Subject: [PATCH 05/11] advanced :runner:

---
 .../endpoint/windows_nirsoft_advancedrun.yml  | 74 +++++++++++++++++++
 .../windows_nirsoft_advancedrun.test.yml      | 12 +++
 2 files changed, 86 insertions(+)
 create mode 100644 detections/endpoint/windows_nirsoft_advancedrun.yml
 create mode 100644 tests/endpoint/windows_nirsoft_advancedrun.test.yml

diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml
new file mode 100644
index 0000000000..6ff85dd6c3
--- /dev/null
+++ b/detections/endpoint/windows_nirsoft_advancedrun.yml
@@ -0,0 +1,74 @@
+name: Windows NirSoft AdvancedRun
+id: bb4f3090-7ae4-11ec-897f-acde48001122
+version: 1
+date: '2022-01-21'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe has similar capabilities as other remote programs like psexec. AdvancedRun may also ingest a configuration file with all settings defined and perform its activity. 
+  The analytic is written in a way to identify a renamed binary and also the common command-line arguments.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=advancedrun.exe OR Processes.original_file_name=advancedrun.exe)
+  Processes.process IN ("*EXEFilename*","*/cfg*","*RunAs*", "*WindowState*") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `windows_nirsoft_advancedrun_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives should be limited as it is specific to AdvancedRun. Filter as needed based on legitimate usage.
+references:
+  - http://www.nirsoft.net/utils/advanced_run.html
+  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+tags:
+  analytic_story:
+  - Unusual Processes
+  - Ransomware
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1588.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 60
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 60
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/windows_nirsoft_advancedrun.test.yml b/tests/endpoint/windows_nirsoft_advancedrun.test.yml
new file mode 100644
index 0000000000..94a1827e21
--- /dev/null
+++ b/tests/endpoint/windows_nirsoft_advancedrun.test.yml
@@ -0,0 +1,12 @@
+name: Windows NirSoft AdvancedRun Unit Test
+tests:
+- name: Windows NirSoft AdvancedRun
+  file: endpoint/windows_nirsoft_advancedrun.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 9793232a8a1c5f4a2a11b841a5c4661983d129c0 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 24 Jan 2022 11:27:35 -0700
Subject: [PATCH 06/11] Added whispergate story

---
 detections/endpoint/cmd_carry_out_string_command_parameter.yml   | 1 +
 .../impacket_lateral_movement_commandline_parameters.yml         | 1 +
 .../endpoint/malicious_powershell_process___encoded_command.yml  | 1 +
 .../suspicious_process_dns_query_known_abuse_web_services.yml    | 1 +
 .../endpoint/windows_dotnet_binary_in_non_standard_path.yml      | 1 +
 detections/endpoint/windows_installutil_in_non_standard_path.yml | 1 +
 detections/endpoint/windows_nirsoft_advancedrun.yml              | 1 +
 7 files changed, 7 insertions(+)

diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
index e90c54c6dc..d58d8970f2 100644
--- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml
+++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - IcedID
   - Log4Shell CVE-2021-44228
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
index c8955cd92b..8f6faa77bf 100644
--- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
@@ -38,6 +38,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index 5b6db5ac3f..0b1bb8f3ea 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -42,6 +42,7 @@ tags:
   analytic_story:
   - Malicious PowerShell
   - NOBELIUM Group
+  - WhisperGate
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
index a6b92a7f3b..5edadd08ce 100644
--- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
+++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Remcos
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 80
   context:
diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
index c0a3164913..7172db04bf 100644
--- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
+++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
@@ -28,6 +28,7 @@ tags:
   - Unusual Processes
   - Ransomware
   - Signed Binary Proxy Execution InstallUtil
+  - WhisperGate
   dataset: []
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml
index 3518093ccb..35786f4f10 100644
--- a/detections/endpoint/windows_installutil_in_non_standard_path.yml
+++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml
@@ -25,6 +25,7 @@ tags:
   - Unusual Processes
   - Ransomware
   - Signed Binary Proxy Execution InstallUtil
+  - WhisperGate
   dataset: []
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml
index 6ff85dd6c3..aaeed37b90 100644
--- a/detections/endpoint/windows_nirsoft_advancedrun.yml
+++ b/detections/endpoint/windows_nirsoft_advancedrun.yml
@@ -24,6 +24,7 @@ tags:
   analytic_story:
   - Unusual Processes
   - Ransomware
+  - WhisperGate
   dataset: []
   kill_chain_phases:
   - Exploitation

From befe09f77cefdf115b11645fddc66eb6a5df3c3c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 24 Jan 2022 15:07:20 -0700
Subject: [PATCH 07/11] Nirsoft Software

---
 .../endpoint/windows_nirsoft_utilities.yml    | 70 +++++++++++++++++++
 lookups/is_nirsoft_software.csv               | 15 ++++
 lookups/is_nirsoft_software.yml               |  6 ++
 macros/is_nirsoft_software.yml                |  3 +
 .../windows_nirsoft_utilities.test.yml        | 12 ++++
 5 files changed, 106 insertions(+)
 create mode 100644 detections/endpoint/windows_nirsoft_utilities.yml
 create mode 100644 lookups/is_nirsoft_software.csv
 create mode 100644 lookups/is_nirsoft_software.yml
 create mode 100644 macros/is_nirsoft_software.yml
 create mode 100644 tests/endpoint/windows_nirsoft_utilities.test.yml

diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml
new file mode 100644
index 0000000000..93e60fa090
--- /dev/null
+++ b/detections/endpoint/windows_nirsoft_utilities.yml
@@ -0,0 +1,70 @@
+name: Windows NirSoft Utilities
+id: 5b2f4596-7d4c-11ec-88a7-acde48001122
+version: 1
+date: '2022-01-24'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic assists with identifying the proces execution of commonly used utilities from NirSoft. Potentially not adversary behavior, but worth identifying to know if the software is present and being used.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `is_nirsoft_software`
+  | `windows_nirsoft_utilities_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present. Filtering may be required before setting to alert.
+references:
+-  
+tags:
+  analytic_story:
+  - WhisperGate
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1588.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to NiRSoft software usage.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/lookups/is_nirsoft_software.csv b/lookups/is_nirsoft_software.csv
new file mode 100644
index 0000000000..8e2ad32430
--- /dev/null
+++ b/lookups/is_nirsoft_software.csv
@@ -0,0 +1,15 @@
+filename,nirsoftFile
+AdvancedRun.exe,True
+ChromePass.exe,True
+CredHistView.exe,True
+Dialupass.exe,True
+iepv.exe,True
+LostMyPassword.exe,True
+mailpv.exe,True
+mspass.exe,True
+netpass.exe,True
+PasswordFox.exe,True
+PasswordHashesView.exe,True
+PstPassword.exe,True
+RegHiveBackup.exe,True
+WebBrowserPassView.exe,True
\ No newline at end of file
diff --git a/lookups/is_nirsoft_software.yml b/lookups/is_nirsoft_software.yml
new file mode 100644
index 0000000000..bc3d662349
--- /dev/null
+++ b/lookups/is_nirsoft_software.yml
@@ -0,0 +1,6 @@
+default_match: 'false'
+description: A subset of utilities provided by NirSoft that may be used by adversaries.
+filename: is_nirsoft_software.csv
+min_matches: 1
+name: is_nirsoft_software
+case_sensitive_match: 'false'
\ No newline at end of file
diff --git a/macros/is_nirsoft_software.yml b/macros/is_nirsoft_software.yml
new file mode 100644
index 0000000000..3c1f3cabfc
--- /dev/null
+++ b/macros/is_nirsoft_software.yml
@@ -0,0 +1,3 @@
+definition: lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true
+description: This macro is related to potentially identifiable software related to NirSoft. Remove or filter as needed based.
+name: is_nirsoft_software
\ No newline at end of file
diff --git a/tests/endpoint/windows_nirsoft_utilities.test.yml b/tests/endpoint/windows_nirsoft_utilities.test.yml
new file mode 100644
index 0000000000..8b709a49ce
--- /dev/null
+++ b/tests/endpoint/windows_nirsoft_utilities.test.yml
@@ -0,0 +1,12 @@
+name: Windows NirSoft Utilities Unit Test
+tests:
+- name: Windows NirSoft Utilities
+  file: endpoint/windows_nirsoft_utilities.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 425125cbc4d086b61426f0d4e8d6a3799a5dd0ba Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 24 Jan 2022 15:08:39 -0700
Subject: [PATCH 08/11] references

---
 detections/endpoint/windows_nirsoft_utilities.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml
index 93e60fa090..e05740dc16 100644
--- a/detections/endpoint/windows_nirsoft_utilities.yml
+++ b/detections/endpoint/windows_nirsoft_utilities.yml
@@ -16,7 +16,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present. Filtering may be required before setting to alert.
 references:
--  
+  - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A
+  - http://www.nirsoft.net/
+  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - WhisperGate

From 60d321e7a7a1222aaafce91fd2c8dc1d65589885 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 25 Jan 2022 10:03:59 -0700
Subject: [PATCH 09/11] Update windows_nirsoft_utilities.yml

---
 detections/endpoint/windows_nirsoft_utilities.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml
index e05740dc16..d70544336a 100644
--- a/detections/endpoint/windows_nirsoft_utilities.yml
+++ b/detections/endpoint/windows_nirsoft_utilities.yml
@@ -35,11 +35,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From bed699098608f36aac1c91cdb4a9c7771647fd2f Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 26 Jan 2022 13:40:09 -0700
Subject: [PATCH 10/11] datasets

---
 .../endpoint/windows_dotnet_binary_in_non_standard_path.yml  | 5 ++++-
 .../endpoint/windows_installutil_in_non_standard_path.yml    | 5 ++++-
 detections/endpoint/windows_nirsoft_advancedrun.yml          | 5 ++++-
 detections/endpoint/windows_nirsoft_utilities.yml            | 5 ++++-
 4 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
index 7172db04bf..f59321f01a 100644
--- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
+++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
@@ -79,4 +79,7 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log
+  automated_detection_testing: passed
\ No newline at end of file
diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml
index 35786f4f10..f5dd0d2e8f 100644
--- a/detections/endpoint/windows_installutil_in_non_standard_path.yml
+++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml
@@ -76,4 +76,7 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log
+  automated_detection_testing: passed
\ No newline at end of file
diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml
index aaeed37b90..3ce7a246e5 100644
--- a/detections/endpoint/windows_nirsoft_advancedrun.yml
+++ b/detections/endpoint/windows_nirsoft_advancedrun.yml
@@ -72,4 +72,7 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed
\ No newline at end of file
diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml
index d70544336a..24458cac25 100644
--- a/detections/endpoint/windows_nirsoft_utilities.yml
+++ b/detections/endpoint/windows_nirsoft_utilities.yml
@@ -69,4 +69,7 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed
\ No newline at end of file

From 8cb1e0abe043e606a2b5207cf282fb62c2d64d8c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 26 Jan 2022 13:50:32 -0700
Subject: [PATCH 11/11] dataset again

---
 .../endpoint/windows_dotnet_binary_in_non_standard_path.yml      | 1 -
 detections/endpoint/windows_installutil_in_non_standard_path.yml | 1 -
 detections/endpoint/windows_nirsoft_advancedrun.yml              | 1 -
 detections/endpoint/windows_nirsoft_utilities.yml                | 1 -
 4 files changed, 4 deletions(-)

diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
index f59321f01a..e7480f59ca 100644
--- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
+++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
@@ -29,7 +29,6 @@ tags:
   - Ransomware
   - Signed Binary Proxy Execution InstallUtil
   - WhisperGate
-  dataset: []
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml
index f5dd0d2e8f..44c24e0eed 100644
--- a/detections/endpoint/windows_installutil_in_non_standard_path.yml
+++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml
@@ -26,7 +26,6 @@ tags:
   - Ransomware
   - Signed Binary Proxy Execution InstallUtil
   - WhisperGate
-  dataset: []
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml
index 3ce7a246e5..bf33828abe 100644
--- a/detections/endpoint/windows_nirsoft_advancedrun.yml
+++ b/detections/endpoint/windows_nirsoft_advancedrun.yml
@@ -25,7 +25,6 @@ tags:
   - Unusual Processes
   - Ransomware
   - WhisperGate
-  dataset: []
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml
index 24458cac25..d2d81d96b4 100644
--- a/detections/endpoint/windows_nirsoft_utilities.yml
+++ b/detections/endpoint/windows_nirsoft_utilities.yml
@@ -22,7 +22,6 @@ references:
 tags:
   analytic_story:
   - WhisperGate
-  dataset: []
   kill_chain_phases:
   - Exploitation
   mitre_attack_id: