Merge pull request #1844 from splunk/TR-1085_LateralMovement_3

Lateral Movement Content Update #3

detections/endpoint/impacket_lateral_movement_commandline_parameters.yml

@@ -0,0 +1,81 @@
+name: Impacket Lateral Movement Commandline Parameters
+id: 8ce07472-496f-11ec-ab3b-3e22fbd008af
+version: 1
+date: '2021-11-19'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the presence of suspicious commandline parameters
+  typically present when using Impacket tools. Impacket is a collection of python
+  classes meant to be used with Microsoft network protocols. There are multiple scripts
+  that leverage impacket libraries like `wmiexec.py`, `smbexec.py`, `dcomexec.py`
+  and `atexec.py` used to execute commands on remote endpoints. By default, these
+  scripts leverage administrative shares and hardcoded parameters that can be used
+  as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets
+  tools for lateral movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*/c* \\\\127.0.0.1\\*"
+  OR Processes.process= "*/c* 2>&1") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `impacket_lateral_movement_commandline_parameters_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Although uncommon, Administrators may leverage Impackets tools
+  to start a process on remote systems for system administration or automation use
+  cases.
+references:
+- https://attack.mitre.org/techniques/T1021/002/
+- https://attack.mitre.org/techniques/T1021/003/
+- https://attack.mitre.org/techniques/T1047/
+- https://attack.mitre.org/techniques/T1053/
+- https://attack.mitre.org/techniques/T1053/005
+- https://github.com/SecureAuthCorp/impacket
+- https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/impacket/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.002
+  - T1021.003
+  - T1047
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 70
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: Suspicious command line parameters on $dest may represent a lateral movement
+    attack with Impackets tools
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml

@@ -0,0 +1,81 @@
+name: Mmc LOLBAS Execution Process Spawn
+id: f6601940-4c74-11ec-b9b7-3e22fbd008af
+version: 1
+date: '2021-11-23'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution
+  process. When adversaries execute code on remote endpoints abusing the DCOM protocol
+  and the MMC20 COM object, the executed command is spawned as a child processs of
+  `mmc.exe`. The LOLBAS project documents Windows native binaries that can be abused
+  by threat actors to perform tasks like executing malicious code. Looking for child
+  processes of mmc.exe that are part of the LOLBAS project can help defenders identify
+  lateral movement activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=mmc.exe)
+  (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
+  "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe",
+  "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe",
+  "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
+  "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe",
+  "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe",
+  "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe",
+  "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
+  "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe",
+  "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe",
+  "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Legitimate applications may trigger this behavior, filter as
+  needed.
+references:
+- https://attack.mitre.org/techniques/T1021/003/
+- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
+- https://lolbas-project.github.io/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1021
+  - T1021.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: Mmc.exe spawned a LOLBAS process on $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/services_exe_lolbas_execution_process_spawn.yml

@@ -0,0 +1,81 @@
+name: Services LOLBAS Execution Process Spawn
+id: ba9e1954-4c04-11ec-8b74-3e22fbd008af
+version: 1
+date: '2021-11-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies `services.exe` spawning a LOLBAS execution
+  process. When adversaries execute code on remote endpoints abusing the Service Control
+  Manager and creating a remote malicious service, the executed command is spawned
+  as a child processs of `services.exe`. The LOLBAS project documents Windows native
+  binaries that can be abused by threat actors to perform tasks like executing malicious
+  code. Looking for child processes of services.exe that are part of the LOLBAS project
+  can help defenders identify lateral movement activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=services.exe)
+  (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
+  "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe",
+  "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe",
+  "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
+  "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe",
+  "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe",
+  "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe",
+  "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
+  "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe",
+  "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe",
+  "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `services_lolbas_execution_process_spawn_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Legitimate applications may trigger this behavior, filter as
+  needed.
+references:
+- https://attack.mitre.org/techniques/T1543/003/
+- https://pentestlab.blog/2020/07/21/lateral-movement-services/
+- https://lolbas-project.github.io/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1543
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: Services.exe spawned a LOLBAS process on $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml

@@ -0,0 +1,80 @@
+name: Svchost LOLBAS Execution Process Spawn
+id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af
+version: 1
+date: '2021-11-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution
+  process. When adversaries execute code on remote endpoints abusing the Task Scheduler
+  and creating a malicious remote scheduled task, the executed command is spawned
+  as a child processs of `svchost.exe`. The LOLBAS project documents Windows native
+  binaries that can be abused by threat actors to perform tasks like executing malicious
+  code. Looking for child processes of svchost.exe that are part of the LOLBAS project
+  can help defenders identify lateral movement activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe)
+  (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
+  "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe",
+  "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe",
+  "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe",
+  "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe",
+  "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe",
+  "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe",
+  "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe",
+  "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe",
+  "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe",
+  "Msconfig.exe")) by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Legitimate applications may trigger this behavior, filter as
+  needed.
+references:
+- https://attack.mitre.org/techniques/T1053/005/
+- https://www.ired.team/offensive-security/persistence/t1053-schtask
+- https://lolbas-project.github.io/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-security.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1053
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: Svchost.exe spawned a LOLBAS process on $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/windows_service_created_with_suspicious_service_path.yml

@@ -1,40 +1,48 @@
-name: Create Service In Suspicious File Path
+name: Windows Service Created With Suspicious Service Path
 id: 429141be-8311-11eb-adb6-acde48001122
-version: 1
-date: '2021-03-12'
-author: Teoderick Contreras
+version: 2
+date: '2021-11-22'
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This detection is to identify a creation of "user mode service" where
-  the service file path is located in non-common service folder in windows.
+description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`,
+  to identify the creation of a Windows Service where the service binary path path
+  is located in a non-common Service folder in Windows. Red Teams and adversaries
+  alike may create malicious Services for lateral movement or remote code execution
+  as well as persistence and execution. The Clop ransomware has also been seen in
+  the wild abusing Windows services.
 search: ' `wineventlog_system` EventCode=7045  Service_File_Name = "*\.exe" NOT (Service_File_Name
   IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*"))
-  Service_Type = "user mode service" | stats count min(_time) as firstTime max(_time)
-  as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_service_in_suspicious_file_path_filter`'
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
+  Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the Service name, Service File Name Service Start type, and Service Type
   from your endpoints.
-known_false_positives: unknown
+known_false_positives: Legitimate applications may install services with uncommon
+  services paths.
 references:
 - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
 tags:
   analytic_story:
   - Clop Ransomware
+  - Lateral Movement
   automated_detection_testing: passed
   confidence: 80
   context:
   - Source:Endpoint
   - Stage:Privilege Escalation
+  - Stage:Lateral Movement
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log
   impact: 70
   kill_chain_phases:
   - Privilege Escalation
+  - Lateral Movement
   message: A service $Service_File_Name$ was created from a non-standard path using
-    $Service_Name$, potentially leading to a privilege escalation.
+    $Service_Name$
   mitre_attack_id:
   - T1569
   - T1569.002

detections/endpoint/windows_service_created_within_public_path.yml

@@ -0,0 +1,66 @@
+name: Windows Service Created Within Public Path
+id: 3abb2eda-4bb8-11ec-9ae4-3e22fbd008af
+version: 1
+date: '2021-11-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`,
+  to identify the creation of a Windows Service where the service binary path is located
+  in public paths. This behavior could represent the installation of a malicious service.
+  Red Teams and adversaries alike may create malicious Services for lateral movement
+  or remote code execution
+search: '`wineventlog_system` EventCode=7045  Service_File_Name = "*\.exe" NOT (Service_File_Name
+  IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode
+  Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_service_created_within_public_path_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints.
+known_false_positives: Legitimate applications may install services with uncommon
+  services paths.
+references:
+- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager
+- https://pentestlab.blog/2020/07/21/lateral-movement-services/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_suspicious_path/windows-system.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1543
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - EventCode
+  - Service_File_Name
+  - Service_Type
+  - _time
+  - Service_Name
+  - Service_Start_Type
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Service $Service_File_Name$ with a public path was created on
+    $ComputerName
+  observable:
+  - name: Service_File_Name
+    type: Other
+    role:
+    - Other
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml

@@ -0,0 +1,80 @@
+name: Wmiprsve LOLBAS Execution Process Spawn
+id: 95a455f0-4c04-11ec-b8ac-3e22fbd008af
+version: 1
+date: '2021-11-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution
+  process. When adversaries execute code on remote endpoints abusing Windows Management
+  Instrumention (WMI), the executed command is spawned as a child processs of `wmiprvse.exe`.
+  The LOLBAS project documents Windows native binaries that can be abused by threat
+  actors to perform tasks like executing malicious code. Looking for child processes
+  of wmiprvse.exe that are part of the LOLBAS project can help defenders identify
+  lateral movement activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe)
+  (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
+  "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe",
+  "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe",
+  "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
+  "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe",
+  "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe",
+  "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe",
+  "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
+  "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe",
+  "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe",
+  "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprsve_lolbas_execution_process_spawn_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Legitimate applications may trigger this behavior, filter as
+  needed.
+references:
+- https://attack.mitre.org/techniques/T1047/
+- https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement
+- https://lolbas-project.github.io/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1047
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: Wmiprsve.exe spawned a LOLBAS process on $dest$.
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml

@@ -0,0 +1,81 @@
+name: Wsmprovhost LOLBAS Execution Process Spawn
+id: 2eed004c-4c0d-11ec-93e8-3e22fbd008af
+version: 1
+date: '2021-11-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS
+  execution process. When adversaries execute code on remote endpoints abusing the
+  Windows Remote Management (WinRm) protocol, the executed command is spawned as a
+  child processs of `Wsmprovhost.exe`. The LOLBAS project documents Windows native
+  binaries that can be abused by threat actors to perform tasks like executing malicious
+  code. Looking for child processes of Wsmprovhost.exe that are part of the LOLBAS
+  project can help defenders identify lateral movement activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wsmprovhost.exe)
+  (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
+  "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe",
+  "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe",
+  "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
+  "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe",
+  "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe",
+  "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe",
+  "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
+  "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe",
+  "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe",
+  "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wsmprovhost_lolbas_execution_process_spawn_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Legitimate applications may trigger this behavior, filter as
+  needed.
+references:
+- https://attack.mitre.org/techniques/T1021/006/
+- https://lolbas-project.github.io/
+- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.006
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: Wsmprovhost.exe spawned a LOLBAS process on $dest$.
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

stories/lateral_movement.yml

@@ -1,8 +1,8 @@
 name: Lateral Movement
 id: 399d65dc-1f08-499b-a259-aad9051f38ad
 version: 2
-date: '2020-02-04'
-author: David Dorsey, Splunk
+date: '2021-11-23'
+author: David Dorsey, Mauricio Velazco Splunk
 description: Detect and investigate tactics, techniques, and procedures around how
   attackers move laterally within the enterprise. Because lateral movement can expose
   the adversary to detection, it should be an important focus for security analysts.
@@ -32,6 +32,7 @@ narrative: "Once attackers gain a foothold within an enterprise, they will seek
   \ for all processes to ensure that the attackers did not install unauthorized software."
 references:
 - https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html
+- https://www.youtube.com/watch?v=hVTkkkM9XDg
 tags:
   analytic_story: Lateral Movement
   category:

tests/endpoint/impacket_lateral_movement_commandline_parameters.test.yml

@@ -0,0 +1,12 @@
+name: Impacket Lateral Movement Commandline Parameters Unit Test
+tests:
+- name: Impacket Lateral Movement Commandline Parameters
+  file: endpoint/impacket_lateral_movement_commandline_parameters.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/impacket/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/mmc_exe_lolbas_execution_process_spawn.test.yml

@@ -0,0 +1,12 @@
+name: Mmc EXE LOLBAS Execution Process Spawn Unit Test
+tests:
+- name: Mmc.exe LOLBAS Execution Process Spawn
+  file: endpoint/mmc_exe_lolbas_execution_process_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml

@@ -0,0 +1,12 @@
+name: Services LOLBAS Execution Process Spawn Unit Test
+tests:
+- name: Services.exe LOLBAS Execution Process Spawn
+  file: endpoint/services_exe_lolbas_execution_process_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml

@@ -0,0 +1,12 @@
+name: Svchost LOLBAS Execution Process Spawn Unit Test
+tests:
+- name: Svchost.exe LOLBAS Execution Process Spawn
+  file: endpoint/svchost_exe_lolbas_execution_process_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog

tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml

@@ -1,7 +1,7 @@
-name: Create Service In Suspicious File Path Unit Test
+name: Windows Service Created With Suspicious Service Path Unit Test
 tests:
-- name: Create Service In Suspicious File Path
-  file: endpoint/create_service_in_suspicious_file_path.yml
+- name: Windows Service Created With Suspicious Service Path
+  file: endpoint/windows_service_created_with_suspicious_service_path.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

tests/endpoint/windows_service_created_within_public_path.test.yml

@@ -0,0 +1,12 @@
+name: Windows Service Created Within Public Path Unit Test
+tests:
+- name: Windows Service Created Within Public Path
+  file: endpoint/windows_service_created_within_public_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_suspicious_path/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog

tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml

@@ -0,0 +1,16 @@
+name: Wmiprsve LOLBAS Execution Process Spawn Unit Test
+tests:
+- name: Wmiprsve.exe LOLBAS Execution Process Spawn
+  file: endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+
+
+    

tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml

@@ -0,0 +1,16 @@
+name: Wsmprovhost LOLBAS Execution Process Spawn Unit Test
+tests:
+- name: Wsmprovhost.exe LOLBAS Execution Process Spawn
+  file: endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+
+
+