Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm

detections/endpoint/account_discovery_with_net_app.yml

@@ -16,10 +16,15 @@ description: this search is to detect a potential account discovery series of co
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_net` AND (Processes.process="*user*" OR  Processes.process="*config*" OR Processes.process="*view /all*") by  Processes.process_name Processes.dest Processes.user Processes.parent_process_name
-  | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product..
+  where `process_net` AND (Processes.process="*user*" OR  Processes.process="*config*"
+  OR Processes.process="*view /all*") by  Processes.process_name Processes.dest Processes.user
+  Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product..
 known_false_positives: admin or power user may used this series of command.
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/
@@ -63,11 +68,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -1,7 +1,7 @@
 name: Attempted Credential Dump From Registry via Reg exe
 id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
-version: 5
-date: '2019-12-02'
+version: 6
+date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:

detections/endpoint/batch_file_write_to_system32.yml

@@ -1,19 +1,23 @@
 name: Batch File Write to System32
 id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
-version: 1
-date: '2018-12-14'
+version: 2
+date: '2021-09-16'
 author: Rico Valdez, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: The search looks for a batch file (.bat) written to the Windows system
   directory tree.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name
-  values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path
-  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|
-  rex field=file_name "(?<file_extension>\.[^\.]+)$" | search file_path=*system32*
-  AND file_extension=.bat | `batch_file_write_to_system32_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=*  by _time span=1h Processes.process_id Processes.process_name
+  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
+  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\system32\\*",
+  "*\\syswow64\\*") Filesystem.file_name="*.bat"
+  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
+  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
+  file_name file_path process_name process_path process] | dedup file_create_time
+  | table dest file_create_time, file_name, file_path, process_name  | `batch_file_write_to_system32_filter`'
 how_to_implement: You must be ingesting data that records the file-system activity
   from your hosts to populate the Endpoint file-system data-model node. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which