Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2022-02-07 12:38:00 -08:00
parent 7f307a2b3a 376c5a81e6
commit 6fcac67aae
753 changed files with 3432 additions and 57 deletions
@@ -101,6 +101,11 @@ The SPL above uses the following Lookups:
 #### Known False Positives
 {{ detection.known_false_positives}}

+#### Associated Analytic story
+{% for story in detection.tags.analytic_story -%}
+* [{{ story }}](/stories/{{story|lower|replace(" ", "_")}})
+{% endfor %}
+
 #### Kill Chain Phase
 {% for phase in detection.tags.kill_chain_phases -%}
 * {{ phase }}
@@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
  "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
  "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
-  "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
+  "event_id"), "string", null) | where process IS NOT NULL AND process_name IS NOT NULL AND process_name LIKE "%rundll32.exe%" AND match_regex(process,
  /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
  timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
  "process_name", process_name, "process", process]) | into write_ssa_detected_events();'
@@ -15,9 +15,9 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe"
+  (cmd_line IS NOT NULL AND process_name IS NOT NULL) AND (process_name="wbadmin.exe"
  AND like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,
-  "%systemstatebackup%") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "%systemstatebackup%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
@@ -61,8 +61,8 @@ sidebar:
 | [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
@@ -63,6 +63,10 @@ To successfully implement this search, you must ensure the network router device
 #### Known False Positives
 Legitimate router connections may appear as new connections

+#### Associated Analytic story
+* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -64,6 +64,10 @@ This search uses the Network_Sessions data model shipped with Enterprise Securit
 #### Known False Positives
 This search might be prone to high false positives. Please consider this when conducting analysis or investigations. Authorized devices may be detected as unauthorized. If this is the case, verify the MAC address of the system responsible for the false positive and add it to the Assets and Identity framework with the proper information.

+#### Associated Analytic story
+* [Asset Tracking](/stories/asset_tracking)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Delivery
@@ -66,6 +66,10 @@ To successfully implement this search, it requires that the &#39;Update&#39; dat
 #### Known False Positives
 None identified

+#### Associated Analytic story
+* [Monitor for Updates](/stories/monitor_for_updates)
+
+
 #### Kill Chain Phase


@@ -68,6 +68,11 @@ If Splunk Phantom is also configured in your environment, a playbook called &#34
 #### Known False Positives
 None at this time

+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Suspicious Emails](/stories/suspicious_emails)
+
+
 #### Kill Chain Phase
 * Delivery

@@ -72,6 +72,10 @@ To successfully implement this search you must ensure that DNS data is populatin
 #### Known False Positives
 Legitimate ANY requests may trigger this search, however it is unusual to see a large volume of them under typical circumstances. You may modify the threshold in the search to better suit your environment.

+#### Associated Analytic story
+* [DNS Amplification Attacks](/stories/dns_amplification_attacks)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -71,6 +71,11 @@ You must be ingesting data from the web server or network traffic that contains
 #### Known False Positives
 It&#39;s possible for legitimate HTTP requests to be made to URLs containing the suspicious paths.

+#### Associated Analytic story
+* [JBoss Vulnerability](/stories/jboss_vulnerability)
+* [SamSam Ransomware](/stories/samsam_ransomware)
+
+
 #### Kill Chain Phase
 * Reconnaissance

@@ -65,6 +65,11 @@ You must ingest data from the web server or capture network data that contains w
 #### Known False Positives
 No known false positives for this detection.

+#### Associated Analytic story
+* [JBoss Vulnerability](/stories/jboss_vulnerability)
+* [SamSam Ransomware](/stories/samsam_ransomware)
+
+
 #### Kill Chain Phase
 * Delivery

@@ -66,6 +66,10 @@ You need to ingest data from your web traffic. This can be accomplished by index
 #### Known False Positives
 None at this time

+#### Associated Analytic story
+* [Brand Monitoring](/stories/brand_monitoring)
+
+
 #### Kill Chain Phase
 * Delivery

@@ -60,6 +60,10 @@ This particular search leverages data extracted from Stream:HTTP. You must confi
 #### Known False Positives
 Very few legitimate Content-Type fields will have a length greater than 100 characters.

+#### Associated Analytic story
+* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
+
+
 #### Kill Chain Phase
 * Delivery

@@ -71,6 +71,11 @@ You need to ingest email header data. Specifically the sender&#39;s address (src
 #### Known False Positives
 None at this time

+#### Associated Analytic story
+* [Brand Monitoring](/stories/brand_monitoring)
+* [Suspicious Emails](/stories/suspicious_emails)
+
+
 #### Kill Chain Phase
 * Delivery

@@ -76,6 +76,12 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Additionally, false positives may result when AWS administrators roll out policies enforcing network blocks, causing sudden increases in the number of blocked outbound connections.

+#### Associated Analytic story
+* [AWS Network ACL Activity](/stories/aws_network_acl_activity)
+* [Suspicious AWS Traffic](/stories/suspicious_aws_traffic)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 * Command and Control
@@ -75,6 +75,10 @@ In order to run this search effectively, we highly recommend that you leverage t
 #### Known False Positives
 ICMP packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. As such, it is possible that a large ICMP packet could be perfectly legitimate. If large ICMP packets are associated with command and control traffic, there will typically be a large number of these packets observed over time. If the search is providing a large number of false positives, you can modify the macro `detect_large_outbound_icmp_packets_filter` to adjust the byte threshold or add specific IP addresses to an allow list.

+#### Associated Analytic story
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Command and Control

@@ -77,6 +77,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 S3 buckets can be accessed from any IP, as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past hour

+#### Associated Analytic story
+* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -72,6 +72,10 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. Y
 #### Known False Positives
 After a new image is created, the first systems created with that image will cause this alert to fire.  Verify that the image being used was created by a legitimate user.

+#### Associated Analytic story
+* [Cloud Cryptomining](/stories/cloud_cryptomining)
+
+
 #### Kill Chain Phase


@@ -73,6 +73,10 @@ To successfully implement this search, you must be ingesting the Windows WMI act
 #### Known False Positives
 Although unlikely, administrators may use event subscriptions for legitimate purposes.

+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -71,6 +71,10 @@ To successfully implement this search, you must be ingesting the Windows WMI act
 #### Known False Positives
 Some software may create WMI temporary event subscriptions for various purposes. The included search contains an exception for two of these that occur by default on Windows 10 systems. You may need to modify the search to create exceptions for other legitimate events.

+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -88,6 +88,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment.

+#### Associated Analytic story
+* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -73,6 +73,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators may use this legitimately to gather info from remote systems. Filter as needed.

+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -72,6 +72,11 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 None identified

+#### Associated Analytic story
+* [Windows Log Manipulation](/stories/windows_log_manipulation)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -67,6 +67,10 @@ In order to properly run this search, Splunk needs to ingest data from your web-
 #### Known False Positives
 There are no known false positives.

+#### Associated Analytic story
+* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
+
+
 #### Kill Chain Phase
 * Exploitation

@@ -62,6 +62,10 @@ You must be ingesting data that records file-system activity from your hosts to
 #### Known False Positives
 Because these extensions are not typically used in normal operations, you should investigate all results.

+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+
+
 #### Kill Chain Phase
 * Installation

@@ -69,6 +69,10 @@ You must be ingesting data that records the file-system activity from your hosts
 #### Known False Positives
 No false positives have been identified.

+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+
+
 #### Kill Chain Phase
 * Delivery

@@ -62,6 +62,10 @@ In order to properly run this search, Splunk needs to ingest data from your osqu
 #### Known False Positives
 There might be some false positives as keyboard event taps are used by processes like Siri and Zoom video chat, for some good examples of processes to exclude please see [this](https://github.com/facebook/osquery/pull/5345#issuecomment-454639161) comment.

+#### Associated Analytic story
+* [ColdRoot MacOS RAT](/stories/coldroot_macos_rat)
+
+
 #### Kill Chain Phase
 * Command and Control

@@ -72,6 +72,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 Some of these processes may be used legitimately on web servers during maintenance or other administrative tasks.

+#### Associated Analytic story
+* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -67,6 +67,13 @@ You must be ingesting endpoint data that monitors command lines and populates th
 #### Known False Positives
 Some legitimate applications use long command lines for installs or updates. You should review identified command lines for legitimacy. You may modify the first part of the search to omit legitimate command lines from consideration. If you are seeing more results than desired, you may consider changing the value of threshold in the search to a smaller value. You should also periodically re-run the support search to re-build the ML model on the latest data. You may get unexpected results if the user identified in the results is not present in the data used to build the associated model.

+#### Associated Analytic story
+* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
+* [Unusual Processes](/stories/unusual_processes)
+* [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -76,6 +76,11 @@ This search needs Sysmon Logs and a sysmon configuration, which includes EventCo
 #### Known False Positives
 The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it&#39;s possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.

+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+* [Detect Zerologon Attack](/stories/detect_zerologon_attack)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -74,6 +74,13 @@ This search needs Sysmon Logs and a sysmon configuration, which includes EventCo
 #### Known False Positives
 Other tools can import the same DLLs. These tools should be part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process.

+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+* [Detect Zerologon Attack](/stories/detect_zerologon_attack)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -75,6 +75,10 @@ This search requires Sysmon Logs and a Sysmon configuration, which includes Even
 #### Known False Positives
 Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.

+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -75,6 +75,10 @@ This search needs Sysmon Logs with a Sysmon configuration, which includes EventC
 #### Known False Positives
 Other tools can access LSASS for legitimate reasons and generate an event. In these cases, tweaking the search may help eliminate noise.

+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -80,6 +80,10 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Legitimate administrator usage of Vssadmin or Wmic will create false positives.

+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -88,6 +88,12 @@ Detailed documentation on how to create a new field within Incident Review may b
 #### Known False Positives
 If you are seeing more results than desired, you may consider reducing the value for threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data.

+#### Associated Analytic story
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Command and Control

@@ -3,7 +3,7 @@ title: "Auto Admin Logon Registry Entry"
 excerpt: "Credentials in Registry, Unsecured Credentials"
 categories:
  - Endpoint
-last_modified_at: 2021-09-06
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ this search is to detect a suspicious registry modification to implement auto ad
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2021-09-06
+- **Last Updated**: 2020-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 1379d2b8-0f18-11ec-8ca3-acde48001122

@@ -45,16 +45,20 @@ this search is to detect a suspicious registry modification to implement auto ad

 ```

-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND Registry.registry_value_name=1 by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `auto_admin_logon_registry_entry_filter`
 ```

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that `auto_admin_logon_registry_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -73,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown

+#### Associated Analytic story
+* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation

@@ -101,4 +109,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith



-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/auto_admin_logon_registry_entry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/auto_admin_logon_registry_entry.yml) \| *version*: **2**
@@ -3,7 +3,7 @@ title: "Monitor Registry Keys for Print Monitors"
 excerpt: "Port Monitors, Boot or Logon Autostart Execution"
 categories:
  - Endpoint
-last_modified_at: 2020-11-23
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -29,8 +29,8 @@ This search looks for registry activity associated with modifications to the reg
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
- **Last Updated**: 2020-11-23
- **Author**: Bhavin Patel, Splunk
+- **Last Updated**: 2020-01-28
+- **Author**: Bhavin Patel, Teoderick Contreras, Splunk
 - **ID**: f5f6af30-7ba7-4295-bfe9-07de87c01bbc


@@ -46,8 +46,15 @@ This search looks for registry activity associated with modifications to the reg

 ```

-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name Registry.action 
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `monitor_registry_keys_for_print_monitors_filter`
 ```

@@ -73,6 +80,11 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 You will encounter noise from legitimate print-monitor registry entries.

+#### Associated Analytic story
+* [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -95,7 +107,8 @@ Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://githu
 Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)

 * [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/windows-sysmon.log)
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon.log)



-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/monitor_registry_keys_for_print_monitors.yml) \| *version*: **2**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/monitor_registry_keys_for_print_monitors.yml) \| *version*: **3**
@@ -3,7 +3,7 @@ title: "Registry Keys for Creating SHIM Databases"
 excerpt: "Application Shimming, Event Triggered Execution"
 categories:
  - Endpoint
-last_modified_at: 2020-11-26
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -29,8 +29,8 @@ This search looks for registry activity associated with application compatibilit
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
- **Last Updated**: 2020-11-26
- **Author**: Bhavin Patel, Patrick Bareiss, Splunk
+- **Last Updated**: 2020-01-28
+- **Author**: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk
 - **ID**: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb


@@ -46,16 +46,20 @@ This search looks for registry activity associated with application compatibilit

 ```

-| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB* by Registry.dest Registry.user 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB* by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `registry_keys_for_creating_shim_databases_filter`
 ```

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that `registry_keys_for_creating_shim_databases_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -74,6 +78,11 @@ To successfully implement this search, you must populate the Change_Analysis dat
 #### Known False Positives
 There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications

+#### Associated Analytic story
+* [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -99,4 +108,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith



-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml) \| *version*: **3**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml) \| *version*: **4**
@@ -3,7 +3,7 @@ title: "Sdclt UAC Bypass"
 excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism"
 categories:
  - Endpoint
-last_modified_at: 2021-07-01
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -30,7 +30,7 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2021-07-01
+- **Last Updated**: 2020-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: d71efbf6-da63-11eb-8c6e-acde48001122

@@ -47,16 +47,20 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech

 ```

-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `sdclt_uac_bypass_filter`
 ```

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that `sdclt_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -75,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited to no false positives are expected.

+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation

@@ -105,4 +113,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith



-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/sdclt_uac_bypass.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/sdclt_uac_bypass.yml) \| *version*: **2**
@@ -3,7 +3,7 @@ title: "SilentCleanup UAC Bypass"
 excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism"
 categories:
  - Endpoint
-last_modified_at: 2021-07-01
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -30,7 +30,7 @@ This search is to detect a suspicious modification of registry that may related
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2021-07-01
+- **Last Updated**: 2020-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 56d7cfcc-da63-11eb-92d4-acde48001122

@@ -47,16 +47,20 @@ This search is to detect a suspicious modification of registry that may related

 ```

-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_name = "*.exe*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_data = "*.exe*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `silentcleanup_uac_bypass_filter`
 ```

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that `silentcleanup_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -75,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown

+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation

@@ -104,4 +112,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith



-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/silentcleanup_uac_bypass.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/silentcleanup_uac_bypass.yml) \| *version*: **2**
@@ -3,7 +3,7 @@ title: "WSReset UAC Bypass"
 excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism"
 categories:
  - Endpoint
-last_modified_at: 2021-07-01
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -30,7 +30,7 @@ This search is to detect a suspicious modification of registry related to UAC by
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2021-07-01
+- **Last Updated**: 2020-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 8b5901bc-da63-11eb-be43-acde48001122

@@ -47,16 +47,20 @@ This search is to detect a suspicious modification of registry related to UAC by

 ```

-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "DelegateExecute") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" AND (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "DelegateExecute") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `wsreset_uac_bypass_filter`
 ```

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that `wsreset_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -75,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown

+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation

@@ -104,4 +112,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith



-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wsreset_uac_bypass.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wsreset_uac_bypass.yml) \| *version*: **2**
@@ -73,6 +73,10 @@ This search requires Sysmon Logs and a Sysmon configuration, which includes Even
 #### Known False Positives
 Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.

+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -64,6 +64,9 @@ In order to properly run this search, Splunk needs to ingest process data from y
 #### Known False Positives
 At this stage, there are no known false positives. During testing, no process events refering the com.apple.loginwindow.plist files were observed during normal operation of re-opening applications on reboot. Therefore, it can be asumed that any occurences of this in the process events would be worth investigating. In the event that the legitimate modification by the system of these files is in fact logged to the process log, then the process_name of that process can be added to an allow list.

+#### Associated Analytic story
+
+
 #### Kill Chain Phase
 * Installation
 * Command and Control
@@ -62,6 +62,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 Uploading container is a normal behavior from developers or users with access to container registry.

+#### Associated Analytic story
+* [Container Implantation Monitoring and Investigation](/stories/container_implantation_monitoring_and_investigation)
+
+
 #### Kill Chain Phase


@@ -81,6 +81,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 None identified.

+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -75,6 +75,10 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Some legitimate printer-related processes may show up as children of spoolsv.exe. You should confirm that any activity as legitimate and may be added as exclusions in the search.

+#### Associated Analytic story
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Exploitation

@@ -75,6 +75,12 @@ To successfully implement this search, you must be ingesting data that records p
 #### Known False Positives
 Some legitimate processes may be only rarely executed in your environment. As these are identified, update `rare_process_allow_list_local.csv` to filter them out of your search results.

+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Unusual Processes](/stories/unusual_processes)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+
+
 #### Kill Chain Phase
 * Installation
 * Command and Control
@@ -70,6 +70,10 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Although unlikely, administrators may use wmi to execute commands for legitimate purposes.

+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -68,6 +68,10 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed.

+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -60,6 +60,12 @@ In order to implement this search, you must populate the Endpoint file-system da
 #### Known False Positives
 It is important to understand that if you happen to install any new applications on your hosts or are copying a large number of files, you can expect to see a large increase of file modifications.

+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -76,6 +76,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 Not all unauthenticated requests are malicious, but frequency, UA and source IPs will provide context.

+#### Associated Analytic story
+* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
+
+
 #### Kill Chain Phase
 * Reconnaissance

@@ -77,6 +77,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 Not all unauthenticated requests are malicious, but frequency, UA and source IPs and direct request to API provide context.

+#### Associated Analytic story
+* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
+
+
 #### Kill Chain Phase
 * Reconnaissance

@@ -82,6 +82,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 A new child process of zoom isn&#39;t malicious by that fact alone. Further investigation of the actions of the child process is needed to verify any malicious behavior is taken.

+#### Associated Analytic story
+* [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -72,6 +72,10 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. Y
 #### Known False Positives
 Using multiple AWS accounts and roles is perfectly valid behavior. It&#39;s suspicious when an account requests privileges of an account it hasn&#39;t before. You should validate with the account owner that this is a legitimate request.

+#### Associated Analytic story
+* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -67,6 +67,10 @@ You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later
 #### Known False Positives
 When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.

+#### Associated Analytic story
+* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -60,6 +60,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially anonymous suspicious IPs and sensitive objects such as configmaps or secrets

+#### Associated Analytic story
+* [Kubernetes Sensitive Object Access Activity](/stories/kubernetes_sensitive_object_access_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement

@@ -91,6 +91,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 unknown

+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -75,6 +75,10 @@ This search requires you to have enabled your Group Management Audit Logs in you
 #### Known False Positives
 It is possible that an administrator created and deleted an account in a short time period.  Verifying activity with an administrator is advised.

+#### Associated Analytic story
+* [Account Monitoring and Controls](/stories/account_monitoring_and_controls)
+
+
 #### Kill Chain Phase


@@ -70,6 +70,12 @@ To successfully implement this search, you need to be ingesting Windows event lo
 #### Known False Positives
 It is possible that these logs may be legitimately cleared by Administrators. Filter as needed.

+#### Associated Analytic story
+* [Windows Log Manipulation](/stories/windows_log_manipulation)
+* [Ransomware](/stories/ransomware)
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -77,6 +77,13 @@ To successfully implement this search you need to identify systems that commonly
 #### Known False Positives
 Remote Desktop may be used legitimately by users on the network.

+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -74,6 +74,11 @@ You must be ingesting Windows event logs using the Splunk Windows TA and collect
 #### Known False Positives
 The activity may be legitimate. For this reason, it&#39;s best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not &#34;Administrators&#34;, this search may generate an excessive number of false positives

+#### Associated Analytic story
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 * Command and Control
@@ -72,6 +72,10 @@ You must install the GCP App for Splunk (version 2.0.0 or later), then configure
 #### Known False Positives
 Not all unauthenticated requests are malicious, but frequency, User Agent, source IPs and pods  will provide context.

+#### Associated Analytic story
+* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
+
+
 #### Kill Chain Phase
 * Reconnaissance

@@ -88,6 +88,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 None identified. Attempts to disable security-related services should be identified and understood.

+#### Associated Analytic story
+* [Disabling Security Tools](/stories/disabling_security_tools)
+* [Trickbot](/stories/trickbot)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Installation
 * Actions on Objectives
@@ -80,6 +80,10 @@ ou must ingest your Windows security event logs in the `Change` datamodel under
 #### Known False Positives
 It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts.

+#### Associated Analytic story
+* [Account Monitoring and Controls](/stories/account_monitoring_and_controls)
+
+
 #### Kill Chain Phase


@@ -78,6 +78,12 @@ In order to run this search effectively, we highly recommend that you leverage t
 #### Known False Positives
 It is likely that the outbound Server Message Block (SMB) traffic is legitimate, if the company&#39;s internal networks are not well-defined in the Assets and Identity Framework. Categorize the internal CIDR blocks as `internal` in the lookup file to avoid creating notable events for traffic destined to those CIDR blocks. Any other network connection that is going out to the Internet should be investigated and blocked. Best practices suggest preventing external communications of all SMB versions and related protocols at the network boundary.

+#### Associated Analytic story
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 * Command and Control
@@ -87,6 +87,10 @@ You must be ingesting data that records filesystem and process activity from you
 #### Known False Positives
 It is not uncommon for outlook to write legitimate zip files to the disk.

+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Installation
 * Actions on Objectives
@@ -75,6 +75,11 @@ To successfully implement this search, you must be ingesting data that records p
 #### Known False Positives
 Some legitimate applications may exhibit this behavior.

+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
+
+
 #### Kill Chain Phase
 * Exploitation

@@ -72,6 +72,10 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 While legitimate, these NirSoft tools are prone to abuse. You should verfiy that the tool was used for a legitimate purpose.

+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+
+
 #### Kill Chain Phase
 * Installation
 * Actions on Objectives
@@ -76,6 +76,10 @@ To successfully implement this search, you must be ingesting data that records t
 #### Known False Positives
 Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search.

+#### Associated Analytic story
+* [Collection and Staging](/stories/collection_and_staging)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -77,6 +77,11 @@ This search requires you to be ingesting your network traffic and populating the
 #### Known False Positives
 The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers.

+#### Associated Analytic story
+* [Collection and Staging](/stories/collection_and_staging)
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -78,6 +78,11 @@ To successfully implement this search you must ensure that DNS data is populatin
 #### Known False Positives
 It is possible legitimate traffic can trigger this rule. Please investigate as appropriate. The threshold for generating an event can also be customized to better suit your environment.

+#### Associated Analytic story
+* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Command and Control

@@ -79,6 +79,12 @@ While this search does not require you to adhere to Splunk CIM, you must be inge
 #### Known False Positives
 A previously unseen service is not necessarily malicious. Verify that the service is legitimate and that was installed by a legitimate process.

+#### Associated Analytic story
+* [Windows Service Abuse](/stories/windows_service_abuse)
+* [Orangeworm Attack Group](/stories/orangeworm_attack_group)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Installation
 * Actions on Objectives
@@ -74,6 +74,11 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 Some applications and users may legitimately use attrib.exe to interact with the files. 

+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -77,6 +77,10 @@ This search requires you to be ingesting your network traffic and populating the
 #### Known False Positives
 The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers.

+#### Associated Analytic story
+* [Collection and Staging](/stories/collection_and_staging)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -81,6 +81,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate.

+#### Associated Analytic story
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Command and Control
 * Actions on Objectives
@@ -84,6 +84,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you
 #### Known False Positives
 A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise the threshold or except specific IP adresses from triggering this search.

+#### Associated Analytic story
+* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
+
+
 #### Kill Chain Phase


@@ -77,6 +77,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you
 #### Known False Positives
 None. Account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor.

+#### Associated Analytic story
+* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
+
+
 #### Kill Chain Phase


@@ -80,6 +80,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you
 #### Known False Positives
 There may be a faulty config preventing legitmate users from accessing apps they should have access to.

+#### Associated Analytic story
+* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
+
+
 #### Kill Chain Phase


@@ -80,6 +80,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you
 #### Known False Positives
 Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should *not* be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint.

+#### Associated Analytic story
+* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
+
+
 #### Kill Chain Phase


@@ -75,6 +75,10 @@ You must be ingesting data that records the filesystem activity from your hosts
 #### Known False Positives
 Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle.

+#### Associated Analytic story
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -73,6 +73,12 @@ In order to properly run this search, Splunk needs to ingest data from firewalls
 #### Known False Positives
 None identified

+#### Associated Analytic story
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+* [Ransomware](/stories/ransomware)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Delivery
 * Command and Control
@@ -75,6 +75,11 @@ Running this search properly requires a technology that can inspect network traf
 #### Known False Positives
 None identified

+#### Associated Analytic story
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Command and Control

@@ -75,6 +75,11 @@ You must ensure that your network traffic data is populating the Network_Traffic
 #### Known False Positives
 RDP gateways may have unusually high amounts of traffic from all other hosts&#39; RDP applications in the network.

+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Delivery
@@ -75,6 +75,11 @@ To successfully implement this search, you must be ingesting data that records p
 #### Known False Positives
 Remote Desktop may be used legitimately by users on the network.

+#### Associated Analytic story
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -76,6 +76,15 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate.

+#### Associated Analytic story
+* [Windows Service Abuse](/stories/windows_service_abuse)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [Orangeworm Attack Group](/stories/orangeworm_attack_group)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Disabling Security Tools](/stories/disabling_security_tools)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Installation

@@ -73,6 +73,10 @@ To successfully implement this search, you need to be monitoring network communi
 #### Known False Positives
 It&#39;s possible that legitimate traffic will have long URLs or long user agent strings and that common SQL commands may be found within the URL. Please investigate as appropriate.

+#### Associated Analytic story
+* [SQL Injection](/stories/sql_injection)
+
+
 #### Kill Chain Phase
 * Delivery

@@ -76,6 +76,13 @@ This search requires you to be ingesting your network traffic logs and populatin
 #### Known False Positives
 A file server may experience high-demand loads that could cause this analytic to trigger.

+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [Ransomware](/stories/ransomware)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -82,6 +82,13 @@ Detailed documentation on how to create a new field within Incident Review is fo
 #### Known False Positives
 If you are seeing more results than desired, you may consider reducing the value of the threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data. Please update the `smb_traffic_spike_mltk_filter` macro to filter out false positive results

+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [Ransomware](/stories/ransomware)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -83,6 +83,11 @@ If Splunk Phantom is also configured in your environment, a Playbook called &#34
 #### Known False Positives
 None identified

+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Suspicious Emails](/stories/suspicious_emails)
+
+
 #### Kill Chain Phase
 * Delivery

@@ -80,6 +80,12 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 It&#39;s possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out.

+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Disabling Security Tools](/stories/disabling_security_tools)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -74,6 +74,10 @@ To successfully implement this search you need to be ingesting information on fi
 #### Known False Positives
 Because the Recycle Bin is a hidden folder in modern versions of Windows, it would be unusual for a process other than explorer.exe to write to it. Incidents should be investigated as appropriate.

+#### Associated Analytic story
+* [Collection and Staging](/stories/collection_and_staging)
+
+
 #### Kill Chain Phase


@@ -76,6 +76,13 @@ In order to properly run this search, Splunk needs to ingest data from firewalls
 #### Known False Positives
 None at this time

+#### Associated Analytic story
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+* [Ransomware](/stories/ransomware)
+* [Command and Control](/stories/command_and_control)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Command and Control

@@ -76,6 +76,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives


+#### Associated Analytic story
+* [Disabling Security Tools](/stories/disabling_security_tools)
+
+
 #### Kill Chain Phase
 * Actions on Objectives

@@ -67,6 +67,10 @@ You must install splunk AWS add-on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Attach to policy can create a lot of noise. This search can be adjusted to provide specific values to identify cases of abuse (i.e status=failure). The search can provide context for common users attaching themselves to higher privilege policies or even newly created policies.

+#### Associated Analytic story
+* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement

@@ -77,6 +77,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Not all permanent key creations are malicious. If there is a policy of rotating keys this search can be adjusted to provide better context.

+#### Associated Analytic story
+* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement

@@ -82,6 +82,10 @@ You must install splunk AWS add-on and Splunk App for AWS. This search works wit
 #### Known False Positives
 CreateRole is not very common in common users. This search can be adjusted to provide specific values to identify cases of abuse. In general AWS provides plenty of trust policies that fit most use cases.

+#### Associated Analytic story
+* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement

@@ -76,6 +76,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross account and cross resources access. This search can be adjusted to provide specific values to identify cases of abuse.

+#### Associated Analytic story
+* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement

@@ -75,6 +75,10 @@ You must install splunk AWS add-on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Sts:GetSessionToken can be very noisy as in certain environments numerous calls of this type can be executed. This search can be adjusted to provide specific values to identify cases of abuse. In specific environments the use of field requestParameters.serialNumber will need to be used.

+#### Associated Analytic story
+* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement

@@ -71,6 +71,10 @@ You must be ingesting Splunk Stream DNS and Splunk Stream TCP. We are detecting
 #### Known False Positives
 unknown

+#### Associated Analytic story
+* [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350)
+
+
 #### Kill Chain Phase
 * Exploitation

@@ -75,6 +75,10 @@ You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should
 #### Known False Positives
 unknown

+#### Associated Analytic story
+* [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350)
+
+
 #### Kill Chain Phase
 * Exploitation

--- a/Show More
+++ b/Show More