Branch was auto-updated.

.github/labeler.yml

@@ -2,7 +2,6 @@ Detections:
 - changed-files:
   - any-glob-to-any-file: 
     - detections/**
-    - dev/**
 
 Stories:
 - changed-files:

dev/endpoint/7zip_commandline_to_smb_share_path.yml

@@ -1,68 +0,0 @@
-name: 7zip CommandLine To SMB Share Path
-id: 01d29b48-ff6f-11eb-b81e-acde48001122
-version: 1
-date: '2021-08-17'
-author: Teoderick Contreras, Splunk
-status: production
-type: Hunting
-description: This search is to detect a suspicious 7z process with commandline pointing
-  to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z
-  to archive a sensitive files and place it in network share tmp folder. This search
-  is a good hunting query that may give analyst a hint why specific user try to archive
-  a file pointing to SMB user which is un usual.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: 7z.exe
-  selection2:
-    Image|endswith:
-    - 7z.exe
-    - 7za.exe
-  selection3:
-    OriginalFileName: 7za.exe
-  selection4:
-    CommandLine:
-    - '*\\C$\\*'
-    - '*\\Admin$\\*'
-    - '*\\IPC$\\*'
-  condition: (selection1 or selection2 or selection3) and selection4
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used.
-known_false_positives: unknown
-references:
-- https://threadreaderapp.com/thread/1423361119926816776.html
-tags:
-  analytic_story:
-  - Ransomware
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: archive process $process_name$ with suspicious cmdline $process$ in host
-    $dest$
-  mitre_attack_id:
-  - T1560.001
-  - T1560
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: SourceImage
-    type: Process
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon_7z.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/active_setup_registry_autostart.yml

@@ -1,64 +0,0 @@
-name: Active Setup Registry Autostart
-id: f64579c0-203f-11ec-abcc-acde48001122
-version: 2
-date: '2022-01-26'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic is to detect a suspicious modification of the active setup
-  registry for persistence and privilege escalation. This technique was seen in several
-  malware (poisonIvy), adware and APT to gain persistence to the compromised machine
-  upon boot up. This TTP is a good indicator to further check the process id that
-  do the modification since modification of this registry is not commonly done. check
-  the legitimacy of the file and process involve in this rules to check if it is a
-  valid setup installer that creating or modifying this registry.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    TargetObject: '*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*'
-    Registry.registry_value_name: StubPath
-  condition: selection1
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: Active setup installer may add or modify this registry.
-references:
-- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3AWin32%2FPoisonivy.E
-- https://attack.mitre.org/techniques/T1547/014/
-tags:
-  analytic_story:
-  - Windows Persistence Techniques
-  - Windows Privilege Escalation
-  - Hermetic Wiper
-  asset_type: Endpoint
-  confidence: 80
-  impact: 80
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
-  mitre_attack_id:
-  - T1547.014
-  - T1547
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 64
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/add_defaultuser_and_password_in_registry.yml

@@ -1,57 +0,0 @@
-name: Add DefaultUser And Password In Registry
-id: d4a3eb62-0f1e-11ec-a971-acde48001122
-version: 2
-date: '2022-01-26'
-author: Teoderick Contreras, Splunk
-status: production
-type: Anomaly
-description: this search is to detect a suspicious registry modification to implement
-  auto admin logon to a host. This technique was seen in BlackMatter ransomware to
-  automatically logon to the compromise host after  triggering a safemode boot to
-  continue encrypting the whole network. This behavior is not a common practice and
-  really a suspicious TTP or alert need to be consider if found within then network
-  premise.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Registry.registry_value_name:
-    - DefaultPassword
-    - DefaultUserName
-    TargetObject: '*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: unknown
-references:
-- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
-tags:
-  analytic_story:
-  - BlackMatter Ransomware
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: modified registry key $registry_key_name$ with registry value $registry_value_name$
-    to prepare autoadminlogon
-  mitre_attack_id:
-  - T1552.002
-  - T1552
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/add_or_set_windows_defender_exclusion.yml

@@ -1,68 +0,0 @@
-name: Add or Set Windows Defender Exclusion
-id: 773b66fe-4dd9-11ec-8289-acde48001122
-version: 1
-date: '2021-11-25'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic will identify a suspicious process command-line related
-  to Windows Defender exclusion feature. This command is abused by adversaries, malware
-  authors and red teams to bypass Windows Defender Antivirus products by excluding
-  folder path, file path, process and extensions. From its real time or schedule scan
-  to execute their malicious code. This is a good indicator for defense evasion and
-  to look further for events after this behavior.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*-exclusion*'
-  selection2:
-    CommandLine:
-    - '*Add-MpPreference *'
-    - '*Set-MpPreference *'
-  condition: selection1 and selection2
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: Admin or user may choose to use this windows features. Filter
-  as needed.
-references:
-- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
-- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
-tags:
-  analytic_story:
-  - Remcos
-  - Windows Defense Evasion Tactics
-  - WhisperGate
-  - CISA AA22-320A
-  - AgentTesla
-  asset_type: Endpoint
-  confidence: 80
-  impact: 80
-  message: exclusion command $process$ executed on $dest$
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 64
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/allow_file_and_printing_sharing_in_firewall.yml

@@ -1,59 +0,0 @@
-name: Allow File And Printing Sharing In Firewall
-id: ce27646e-d411-11eb-8a00-acde48001122
-version: 2
-date: '2021-06-23'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search is to detect a suspicious modification of firewall to allow
-  file and printer sharing. This technique was seen in ransomware to be able to discover
-  more machine connected to the compromised host to encrypt more files
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: netsh.exe
-  selection2:
-    Image|endswith: netsh.exe
-  selection3:
-    CommandLine: '*firewall*'
-  selection4:
-    CommandLine: '*group='
-  condition: (selection1 or selection2) and selection3 and selection4
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: network admin may modify this firewall feature that may cause
-  this rule to be triggered.
-references:
-- https://community.fortinet.com:443/t5/FortiEDR/How-FortiEDR-detects-and-blocks-Revil-Ransomware-aka-sodinokibi/ta-p/189638?externalID=FD52469
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
-tags:
-  analytic_story:
-  - Ransomware
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: ''
-  mitre_attack_id:
-  - T1562.007
-  - T1562
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25.0
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -1,64 +0,0 @@
-name: Allow Inbound Traffic By Firewall Rule Registry
-id: 0a46537c-be02-11eb-92ca-acde48001122
-version: 3
-date: '2022-07-19'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic detects a potential suspicious modification of firewall
-  rule registry allowing inbound traffic in specific port with public profile. This
-  technique was identified when an adversary wants to grant remote access to a machine
-  by allowing the traffic in a firewall rule.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '*|Action='
-    TargetObject: '*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*'
-  selection2:
-    Details: '*|Dir='
-  selection3:
-    Details: '*|LPort='
-  condition: selection1 and selection2 and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: network admin may add/remove/modify public inbound firewall
-  rule that may cause this rule to be triggered.
-references:
-- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
-tags:
-  analytic_story:
-  - Prohibited Traffic Allowed or Protocol Mismatch
-  - Windows Registry Abuse
-  - Azorult
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: Suspicious firewall allow rule modifications were detected via the registry
-    on endpoint $dest$ by user $user$.
-  mitre_attack_id:
-  - T1021.001
-  - T1021
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/allow_network_discovery_in_firewall.yml

@@ -1,61 +0,0 @@
-name: Allow Network Discovery In Firewall
-id: ccd6a38c-d40b-11eb-85a5-acde48001122
-version: 2
-date: '2021-06-23'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search is to detect a suspicious modification to the firewall to
-  allow network discovery on a machine. This technique was seen in couple of ransomware
-  (revil, reddot) to discover other machine connected to the compromised host to encrypt
-  more files.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: netsh.exe
-  selection2:
-    Image|endswith: netsh.exe
-  selection3:
-    CommandLine: '*firewall*'
-  selection4:
-    CommandLine: '*group='
-  condition: (selection1 or selection2) and selection3 and selection4
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: network admin may modify this firewall feature that may cause
-  this rule to be triggered.
-references:
-- https://community.fortinet.com:443/t5/FortiEDR/How-FortiEDR-detects-and-blocks-Revil-Ransomware-aka-sodinokibi/ta-p/189638?externalID=FD52469
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
-tags:
-  analytic_story:
-  - Ransomware
-  - Revil Ransomware
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: ''
-  mitre_attack_id:
-  - T1562.007
-  - T1562
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25.0
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/allow_operation_with_consent_admin.yml

@@ -1,63 +0,0 @@
-name: Allow Operation with Consent Admin
-id: 7de17d7a-c9d8-11eb-a812-acde48001122
-version: 2
-date: '2022-01-26'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic identifies a potential privilege escalation attempt to
-  perform malicious task. This registry modification is designed to allow the `Consent
-  Admin` to perform an operation that requires elevation without consent or credentials.
-  We also found this in some attacker to gain privilege escalation to the compromise
-  machine.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Registry.registry_value_name: ConsentPromptBehaviorAdmin
-    TargetObject: '*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*'
-    Details: '0x00000000'
-  condition: selection1
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: unknown
-references:
-- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4
-- https://www.trendmicro.com/vinfo/no/threat-encyclopedia/malware/Ransom.Win32.MRDEC.MRA/
-tags:
-  analytic_story:
-  - Ransomware
-  - Windows Registry Abuse
-  - Azorult
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: Suspicious registry modification was performed on endpoint $dest$ by user
-    $user$. This behavior is indicative of privilege escalation.
-  mitre_attack_id:
-  - T1548
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/anomalous_usage_of_7zip.yml

@@ -1,74 +0,0 @@
-name: Anomalous usage of 7zip
-id: 9364ee8e-a39a-11eb-8f1d-acde48001122
-version: 1
-date: '2021-04-22'
-author: Michael Haag, Teoderick Contreras, Splunk
-status: production
-type: Anomaly
-description: The following detection identifies a 7z.exe spawned from `Rundll32.exe`
-  or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`.
-  It has been observed where an adversary will rename `7z.exe`. Additional coverage
-  may be required to identify the behavior of renamed instances of `7z.exe`. During
-  triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture
-  any files written to disk and analyze as needed. Review parallel processes for additional
-  behaviors. Typically, archiving files will result in exfiltration.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith: '7z.exe'
-    ParentImage:
-    - rundll32.exe
-    - dllhost.exe
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: False positives should be limited as this behavior is not normal
-  for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
-references:
-- https://attack.mitre.org/techniques/T1560/001/
-- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
-- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/
-tags:
-  analytic_story:
-  - Cobalt Strike
-  - NOBELIUM Group
-  asset_type: Endpoint
-  confidence: 80
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading
-    of 7zip.
-  mitre_attack_id:
-  - T1560.001
-  - T1560
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 64
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/any_powershell_downloadfile.yml

@@ -1,91 +0,0 @@
-name: Any Powershell DownloadFile
-id: 1a93b7ea-7af7-11eb-adb5-acde48001122
-version: 3
-date: '2022-04-07'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies the use of PowerShell downloading a
-  file using `DownloadFile` method. This particular method is utilized in many different
-  PowerShell frameworks to download files and output to disk. Identify the source
-  (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
-  transaction logs are available, review for further details of the implant.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: pwsh.dll
-  selection2:
-    Image|endswith:
-    - pwsh.exe
-    - sqlps.exe
-    - sqltoolsps.exe
-    - powershell.exe
-    - powershell_ise.exe
-  selection3:
-    OriginalFileName: PowerShell.EXE
-  selection4:
-    OriginalFileName: powershell_ise.EXE
-  selection5:
-    CommandLine: '*DownloadFile*'
-  condition: (selection1 or selection2 or selection3 or selection4) and selection5
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be present and filtering will need to occur
-  by parent process or command line argument. It may be required to modify this query
-  to an EDR product for more granular coverage.
-references:
-- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0
-- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
-tags:
-  analytic_story:
-  - Hermetic Wiper
-  - Malicious PowerShell
-  - Ingress Tool Transfer
-  - Log4Shell CVE-2021-44228
-  - DarkCrystal RAT
-  asset_type: Endpoint
-  confidence: 70
-  cve:
-  - CVE-2021-44228
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile
-    within PowerShell.
-  mitre_attack_id:
-  - T1059
-  - T1059.001
-  - T1105
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 56
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/any_powershell_downloadstring.yml

@@ -1,88 +0,0 @@
-name: Any Powershell DownloadString
-id: 4d015ef2-7adf-11eb-95da-acde48001122
-version: 3
-date: '2022-04-07'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies the use of PowerShell downloading a
-  file using `DownloadString` method. This particular method is utilized in many different
-  PowerShell frameworks to download files and output to disk. Identify the source
-  (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
-  transaction logs are available, review for further details of the implant.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: pwsh.dll
-  selection2:
-    Image|endswith:
-    - pwsh.exe
-    - sqlps.exe
-    - sqltoolsps.exe
-    - powershell.exe
-    - powershell_ise.exe
-  selection3:
-    OriginalFileName: PowerShell.EXE
-  selection4:
-    OriginalFileName: powershell_ise.EXE
-  selection5:
-    CommandLine: '*.DownloadString*'
-  condition: (selection1 or selection2 or selection3 or selection4) and selection5
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be present and filtering will need to occur
-  by parent process or command line argument. It may be required to modify this query
-  to an EDR product for more granular coverage.
-references:
-- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0
-- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
-tags:
-  analytic_story:
-  - Hermetic Wiper
-  - Malicious PowerShell
-  - HAFNIUM Group
-  - Ingress Tool Transfer
-  asset_type: Endpoint
-  confidence: 70
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString
-    within PowerShell.
-  mitre_attack_id:
-  - T1059
-  - T1059.001
-  - T1105
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 56
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/attacker_tools_on_endpoint.yml

@@ -1,72 +0,0 @@
-name: Attacker Tools On Endpoint
-id: a51bfe1a-94f0-48cc-b4e4-16a110145893
-version: 2
-date: '2021-11-04'
-author: Bhavin Patel, Splunk
-status: production
-type: TTP
-description: This search looks for execution of commonly used attacker tools on an
-  endpoint.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    User: unknown
-    Computer: unknown
-  condition: selection1
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is usually generated via logs that report process tracking
-  in your Windows audit settings.
-known_false_positives: Some administrator activity can be potentially triggered, please
-  add those users to the filter macro.
-references: []
-tags:
-  analytic_story:
-  - Monitor for Unauthorized Software
-  - XMRig
-  - SamSam Ransomware
-  - Unusual Processes
-  - CISA AA22-264A
-  asset_type: Endpoint
-  confidence: 80
-  impact: 80
-  message: An attacker tool $process_name$,listed in attacker_tools.csv is executed
-    on host $dest$ by User $user$. This process $process_name$ is known to do- $description$
-  mitre_attack_id:
-  - T1036.005
-  - T1036
-  - T1003
-  - T1595
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 64
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/attempt_to_add_certificate_to_untrusted_store.yml

@@ -1,68 +0,0 @@
-name: Attempt To Add Certificate To Untrusted Store
-id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
-version: 7
-date: '2021-09-16'
-author: Patrick Bareiss, Rico Valdez, Splunk
-status: production
-type: TTP
-description: Attempt To Add Certificate To Untrusted Store
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: CertUtil.exe
-  selection2:
-    Image|endswith: certutil.exe
-  selection3:
-    CommandLine: '*-addstore*'
-  condition: (selection1 or selection2) and selection3
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: There may be legitimate reasons for administrators to add a
-  certificate to the untrusted certificate store. In such cases, this will typically
-  be done on a large number of systems.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
-tags:
-  analytic_story:
-  - Disabling Security Tools
-  asset_type: Endpoint
-  confidence: 50
-  impact: 70
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    attempting to add a certificate to the store on endpoint $dest$ by user $user$.
-  mitre_attack_id:
-  - T1553.004
-  - T1553
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 35
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -1,82 +0,0 @@
-name: Attempted Credential Dump From Registry via Reg exe
-id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
-version: 7
-date: '2022-11-15'
-author: Patrick Bareiss, Splunk
-status: production
-type: TTP
-description: Monitor for execution of reg.exe with parameters specifying an export
-  of keys that contain hashed credentials that attackers may try to crack offline.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine|contains: 'save'
-    Image|endswith:
-    - cmd.exe
-    - reg.exe
-  selection2:
-    CommandLine:
-    - '*HKLM\\SAM*'
-    - '*HKLM\\System*'
-    - '*HKLM\\Security*'
-    - '*HKEY_LOCAL_MACHINE\\System*'
-    - '*HKEY_LOCAL_MACHINE\\SAM*'
-    - '*HKEY_LOCAL_MACHINE\\Security*'
-  condition: selection1 and selection2
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: None identified.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
-tags:
-  analytic_story:
-  - Credential Dumping
-  - DarkSide Ransomware
-  - Windows Registry Abuse
-  - Industroyer2
-  asset_type: Endpoint
-  confidence: 100
-  impact: 90
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to export the registry keys.
-  mitre_attack_id:
-  - T1003.002
-  - T1003
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 90
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log
-    source: crowdstrike
-    sourcetype: crowdstrike:events:sensor

dev/endpoint/auto_admin_logon_registry_entry.yml

@@ -1,57 +0,0 @@
-name: Auto Admin Logon Registry Entry
-id: 1379d2b8-0f18-11ec-8ca3-acde48001122
-version: 2
-date: '2020-01-28'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: this search is to detect a suspicious registry modification to implement
-  auto admin logon to a host. This technique was seen in BlackMatter ransomware to
-  automatically logon to the compromise host after  triggering a safemode boot to
-  continue encrypting the whole network. This behavior is not a common practice and
-  really a suspicious TTP or alert need to be consider if found within then network
-  premise.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Registry.registry_value_name: AutoAdminLogon
-    TargetObject: '*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*'
-    Details: '1'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: unknown
-references:
-- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
-tags:
-  analytic_story:
-  - BlackMatter Ransomware
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 90
-  impact: 70
-  message: modified registry key $registry_key_name$ with registry value $registry_value_name$
-    to prepare autoadminlogon
-  mitre_attack_id:
-  - T1552.002
-  - T1552
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 63
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/batch_file_write_to_system32.yml

@@ -1,64 +0,0 @@
-name: Batch File Write to System32
-id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
-version: 3
-date: '2022-12-21'
-author: Steven Dick, Michael Haag, Rico Valdez, Splunk
-status: production
-type: TTP
-description: The search looks for a batch file (.bat) written to the Windows system
-  directory tree.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith: '*'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: It is possible for this search to generate a notable event
-  for a batch file write to a path that includes the string "system32", but is not
-  the actual Windows system directory. As such, you should confirm the path of the
-  batch file identified by the search. In addition, a false positive may be generated
-  by an administrator copying a legitimate batch file in this directory tree. You
-  should confirm that the activity is legitimate and modify the search to add exclusions,
-  as necessary.
-references: []
-tags:
-  analytic_story:
-  - SamSam Ransomware
-  asset_type: Endpoint
-  confidence: 90
-  impact: 70
-  message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$
-    by user $user$.
-  mitre_attack_id:
-  - T1204
-  - T1204.002
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: file_name
-    type: File Name
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 63
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/bcdedit_command_back_to_normal_mode_boot.yml

@@ -1,62 +0,0 @@
-name: Bcdedit Command Back To Normal Mode Boot
-id: dc7a8004-0f18-11ec-8c54-acde48001122
-version: 1
-date: '2021-09-06'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search is to detect a suspicious bcdedit commandline to configure
-  the host from safe mode back to normal boot configuration. This technique was seen
-  in blackMatter ransomware where it force the compromised host to boot in safe mode
-  to continue its encryption and bring back to normal boot using bcdedit deletevalue
-  command. This TTP can be a good alert for host that booted from safe mode forcefully
-  since it need to modify the boot configuration to bring it back to normal.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*/deletevalue*'
-    Image|endswith: bcdedit.exe
-  selection2:
-    CommandLine: '*{current}*'
-  selection3:
-    CommandLine: '*safeboot*'
-  condition: selection1 and selection2 and selection3
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: unknown
-references:
-- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
-tags:
-  analytic_story:
-  - BlackMatter Ransomware
-  asset_type: Endpoint
-  confidence: 70
-  impact: 50
-  message: bcdedit process with commandline $process$ to bring back to normal boot
-    configuration the $dest$
-  mitre_attack_id:
-  - T1490
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 35
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/bcdedit_failure_recovery_modification.yml

@@ -1,67 +0,0 @@
-name: BCDEdit Failure Recovery Modification
-id: 809b31d2-5462-11eb-ae93-0242ac130002
-version: 1
-date: '2020-12-21'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: This search looks for flags passed to bcdedit.exe modifications to the
-  built-in Windows error recovery boot configurations. This is typically used by ransomware
-  to prevent recovery.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*recoveryenabled*'
-    Image|endswith: bcdedit.exe
-  selection2:
-    CommandLine: '* no*'
-  condition: selection1 and selection2
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. Tune based on parent process names.
-known_false_positives: Administrators may modify the boot configuration.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
-tags:
-  analytic_story:
-  - Ryuk Ransomware
-  - Ransomware
-  asset_type: Endpoint
-  confidence: 80
-  impact: 100
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting disable the ability to recover the
-    endpoint.
-  mitre_attack_id:
-  - T1490
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
-    update_timestamp: true

dev/endpoint/bits_job_persistence.yml

@@ -1,82 +0,0 @@
-name: BITS Job Persistence
-id: e97a5ffe-90bf-11eb-928a-acde48001122
-version: 2
-date: '2021-09-16'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following query identifies Microsoft Background Intelligent Transfer
-  Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
-  The query identifies the parameters used to create, resume or add a file to a BITS
-  job. Typically seen combined in a oneliner or ran in sequence. If identified, review
-  the BITS job created and capture any files written to disk. It is possible for BITS
-  to be used to upload files and this may require further network data analysis to
-  identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: bitsadmin.exe
-  selection2:
-    Image|endswith: bitsadmin.exe
-  selection3:
-    CommandLine: []
-  condition: (selection1 or selection2) and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives will be present. Typically, applications
-  will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
-  (legitimate applications) or parent process.
-references:
-- https://attack.mitre.org/techniques/T1197/
-- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
-- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
-tags:
-  analytic_story:
-  - BITS Jobs
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 80
-  impact: 70
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to persist using BITS.
-  mitre_attack_id:
-  - T1197
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 56
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log
-    source: crowdstrike
-    sourcetype: crowdstrike:events:sensor

dev/endpoint/bitsadmin_download_file.yml

@@ -1,91 +0,0 @@
-name: BITSAdmin Download File
-id: 80630ff4-8e4c-11eb-aab5-acde48001122
-version: 3
-date: '2022-11-29'
-author: Michael Haag, Sittikorn S
-status: production
-type: TTP
-description: The following query identifies Microsoft Background Intelligent Transfer
-  Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
-  object. In addition, look for `download` or `upload` on the command-line, the switches
-  are not required to perform a transfer. Capture any files downloaded. Review the
-  reputation of the IP or domain used. Typically once executed, a follow on command
-  will be used to execute the dropped file. Note that the network connection or file
-  modification events related will not spawn or create from `bitsadmin.exe`, but the
-  artifacts will appear in a parallel process of `svchost.exe` with a command-line
-  similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel
-  and child processes to capture any behaviors and artifacts. In some suspicious and
-  malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
-  to list out the jobs during investigation.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: bitsadmin.exe
-  selection2:
-    Image|endswith: bitsadmin.exe
-  selection3:
-    CommandLine:
-    - '*transfer*'
-    - '*addfile*'
-  condition: (selection1 or selection2) and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives, however it may be required to filter
-  based on parent process name or network connection.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
-- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
-- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
-- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
-tags:
-  analytic_story:
-  - Ingress Tool Transfer
-  - BITS Jobs
-  - DarkSide Ransomware
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to download a file.
-  mitre_attack_id:
-  - T1197
-  - T1105
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log
-    source: crowdstrike
-    sourcetype: crowdstrike:events:sensor

dev/endpoint/certutil_download_with_urlcache_and_split_arguments.yml

@@ -1,85 +0,0 @@
-name: CertUtil Download With URLCache and Split Arguments
-id: 415b4306-8bfb-11eb-85c4-acde48001122
-version: 3
-date: '2022-02-03'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: Certutil.exe may download a file from a remote destination using `-urlcache`.
-  This behavior does require a URL to be passed on the command-line. In addition,
-  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
-  be used. It is not entirely common for `certutil.exe` to contact public IP space.
-  However, it is uncommon for `certutil.exe` to write files to world writeable paths.
-  
-  During triage, capture any files on disk and review. Review the reputation of the
-  remote IP or domain in question.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: CertUtil.exe
-  selection2:
-    Image|endswith: certutil.exe
-  selection3:
-    CommandLine: '*split*'
-  selection4:
-    CommandLine: '*urlcache*'
-  selection5:
-    CommandLine: '*urlcache*'
-  condition: (selection1 or selection2) and selection3 and selection4 or selection5
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives in most environments, however tune
-  as needed based on parent-child relationship or network connection.
-references:
-- https://attack.mitre.org/techniques/T1105/
-- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
-- https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
-tags:
-  analytic_story:
-  - Ingress Tool Transfer
-  - DarkSide Ransomware
-  - Living Off The Land
-  - ProxyNotShell
-  - CISA AA22-277A
-  - Forest Blizzard
-  - Flax Typhoon
-  asset_type: Endpoint
-  confidence: 100
-  impact: 90
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to download a file.
-  mitre_attack_id:
-  - T1105
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 90
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml

@@ -1,81 +0,0 @@
-name: CertUtil Download With VerifyCtl and Split Arguments
-id: 801ad9e4-8bfb-11eb-8b31-acde48001122
-version: 3
-date: '2022-02-03'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
-  This behavior does require a URL to be passed on the command-line. In addition,
-  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
-  be used. It is not entirely common for `certutil.exe` to contact public IP space.
-  \ During triage, capture any files on disk and review. Review the reputation of
-  the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
-  written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: CertUtil.exe
-  selection2:
-    Image|endswith: certutil.exe
-  selection3:
-    CommandLine: '*split*'
-  selection4:
-    CommandLine: '*verifyctl*'
-  selection5:
-    CommandLine: '*verifyctl*'
-  condition: (selection1 or selection2) and selection3 and selection4 or selection5
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives in most environments, however tune
-  as needed based on parent-child relationship or network connection.
-references:
-- https://attack.mitre.org/techniques/T1105/
-- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
-- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
-- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
-tags:
-  analytic_story:
-  - Ingress Tool Transfer
-  - DarkSide Ransomware
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 100
-  impact: 90
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to download a file.
-  mitre_attack_id:
-  - T1105
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 90
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/certutil_exe_certificate_extraction.yml

@@ -1,65 +0,0 @@
-name: Certutil exe certificate extraction
-id: 337a46be-600f-11eb-ae93-0242ac130002
-version: 2
-date: '2022-07-15'
-author: Rod Soto, Splunk
-status: production
-type: TTP
-description: This search looks for arguments to certutil.exe indicating the manipulation
-  or extraction of Certificate. This certificate can then be used to sign new authentication
-  tokens specially inside Federated environments such as Windows ADFS.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*-exportPFX*'
-    Image|endswith: certutil.exe
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Unless there are specific use cases, manipulating or exporting
-  certificates using certutil is uncommon. Extraction of certificate has been observed
-  during attacks such as Golden SAML and other campaigns targeting Federated services.
-references:
-- https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack
-- https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html
-tags:
-  analytic_story:
-  - Windows Persistence Techniques
-  - Cloud Federated Credential Abuse
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 70
-  impact: 90
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting export a certificate.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 63
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/certutil_with_decode_argument.yml

@@ -1,79 +0,0 @@
-name: CertUtil With Decode Argument
-id: bfe94226-8c10-11eb-a4b3-acde48001122
-version: 2
-date: '2021-03-23'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
-  and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
-  and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
-  file that was downloaded. Once decoded, it will be loaded by a parallel process.
-  Note that there are two additional command switches that may be used - `encodehex`
-  and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
-  further execution. During triage, identify the source of the file being decoded.
-  Review its contents or execution behavior for further analysis.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: CertUtil.exe
-  selection2:
-    Image|endswith: certutil.exe
-  selection3:
-    CommandLine: '*decode*'
-  condition: (selection1 or selection2) and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Typically seen used to `encode` files, but it is possible to
-  see legitimate use of `decode`. Filter based on parent-child relationship, file
-  paths, endpoint or user.
-references:
-- https://attack.mitre.org/techniques/T1140/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
-- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
-- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
-tags:
-  analytic_story:
-  - Deobfuscate-Decode Files or Information
-  - Living Off The Land
-  - Forest Blizzard
-  asset_type: Endpoint
-  confidence: 80
-  impact: 50
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to decode a file.
-  mitre_attack_id:
-  - T1140
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 40
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/change_default_file_association.yml

@@ -1,64 +0,0 @@
-name: Change Default File Association
-id: 462d17d8-1f71-11ec-ad07-acde48001122
-version: 1
-date: '2021-09-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic is developed to detect suspicious registry modification
-  to change the default file association of windows to malicious payload. This technique
-  was seen in some APT where it modify the default process to run file association,
-  like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other
-  payload that will load malicious commands to the compromised host.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    TargetObject: '*HKCR\\*'
-  selection2:
-    TargetObject: '*\\shell\\open\\command\\*'
-  condition: selection1 and selection2
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: unknown
-references:
-- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
-tags:
-  analytic_story:
-  - Windows Persistence Techniques
-  - Windows Privilege Escalation
-  - Windows Registry Abuse
-  - Hermetic Wiper
-  - Prestige Ransomware
-  asset_type: Endpoint
-  confidence: 100
-  impact: 80
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
-  mitre_attack_id:
-  - T1546.001
-  - T1546
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/change_to_safe_mode_with_network_config.yml

@@ -1,63 +0,0 @@
-name: Change To Safe Mode With Network Config
-id: 81f1dce0-0f18-11ec-a5d7-acde48001122
-version: 1
-date: '2021-09-06'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search is to detect a suspicious bcdedit commandline to configure
-  the host to boot in safe mode with network config. This technique was seen in blackMatter
-  ransomware where it force the compromised host to boot in safe mode to continue
-  its encryption and bring back to normal boot using bcdedit deletevalue command.
-  This TTP can be a good alert for host that booted from safe mode forcefully since
-  it need to modify the boot configuration to bring it back to normal.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*/set*'
-    Image|endswith: bcdedit.exe
-  selection2:
-    CommandLine: '*{current}*'
-  selection3:
-    CommandLine: '*safeboot*'
-  selection4:
-    CommandLine: '*network*'
-  condition: selection1 and selection2 and selection3 and selection4
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: unknown
-references:
-- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
-tags:
-  analytic_story:
-  - BlackMatter Ransomware
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: bcdedit process with commandline $process$ to force safemode boot the $dest$
-  mitre_attack_id:
-  - T1490
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/chcp_command_execution.yml

@@ -1,59 +0,0 @@
-name: CHCP Command Execution
-id: 21d236ec-eec1-11eb-b23e-acde48001122
-version: 1
-date: '2021-07-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search is to detect execution of chcp.exe application. this utility
-  is used to change the active code page of the console. This technique was seen in
-  icedid malware to know the locale region/language/country of the compromise host.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    ParentImage: cmd.exe
-    Image|endswith: chcp.com
-    ParentCommandLine: '*/c*'
-  condition: selection1
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed chcp.com may be used.
-known_false_positives: other tools or script may used this to change code page to
-  UTF-* or others
-references:
-- https://ss64.com/nt/chcp.html
-- https://twitter.com/tccontre18/status/1419941156633329665?s=20
-tags:
-  analytic_story:
-  - IcedID
-  - Azorult
-  asset_type: Endpoint
-  confidence: 30
-  impact: 30
-  message: parent process $parent_process_name$ spawning chcp process $process_name$
-    with parent command line $parent_process$
-  mitre_attack_id:
-  - T1059
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 9
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/check_elevated_cmd_using_whoami.yml

@@ -1,62 +0,0 @@
-name: Check Elevated CMD using whoami
-id: a9079b18-1633-11ec-859c-acde48001122
-version: 1
-date: '2021-09-15'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search is to detect a suspicious whoami execution to check if the
-  cmd or shell instance process is with elevated privileges. This technique was seen
-  in FIN7 js implant where it execute this as part of its data collection to the infected
-  machine to check if the running shell cmd process is elevated or not. This TTP is
-  really a good alert for known attacker that recon on the targetted host. This command
-  is not so commonly executed by a normal user or even an admin to check if a process
-  is elevated.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*/group*'
-  selection2:
-    CommandLine: '*whoami*'
-  selection3:
-    CommandLine: '* find *'
-  selection4:
-    CommandLine: '*12288*'
-  condition: selection1 and selection2 and selection3 and selection4
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: unknown
-references: []
-tags:
-  analytic_story:
-  - FIN7
-  asset_type: Endpoint
-  confidence: 80
-  impact: 70
-  message: Process name $process_name$ with commandline $process$ in $dest$
-  mitre_attack_id:
-  - T1033
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 56
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/child_processes_of_spoolsv_exe.yml

@@ -1,54 +0,0 @@
-name: Child Processes of Spoolsv exe
-id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df
-version: 3
-date: '2020-03-16'
-author: Rico Valdez, Splunk
-status: experimental
-type: TTP
-description: This search looks for child processes of spoolsv.exe. This activity is
-  associated with a POC privilege-escalation exploit associated with CVE-2018-8440.
-  Spoolsv.exe is the process associated with the Print Spooler service in Windows
-  and typically runs as SYSTEM.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith: regsvr32.exe
-    ParentImage: spoolsv.exe
-  condition: selection1
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model. Update the `children_of_spoolsv_filter` macro
-  to filter out legitimate child processes spawned by spoolsv.exe.
-known_false_positives: Some legitimate printer-related processes may show up as children
-  of spoolsv.exe. You should confirm that any activity as legitimate and may be added
-  as exclusions in the search.
-references: []
-tags:
-  analytic_story:
-  - Windows Privilege Escalation
-  - Hermetic Wiper
-  asset_type: Endpoint
-  confidence: 50
-  cve:
-  - CVE-2018-8440
-  impact: 50
-  message: tbd
-  mitre_attack_id:
-  - T1068
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint

dev/endpoint/clear_unallocated_sector_using_cipher_app.yml

@@ -1,65 +0,0 @@
-name: Clear Unallocated Sector Using Cipher App
-id: cd80a6ac-c9d9-11eb-8839-acde48001122
-version: 1
-date: '2021-06-10'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: this search is to detect execution of `cipher.exe` to clear the unallocated
-  sectors of a specific disk. This technique was seen in some ransomware to make it
-  impossible to forensically recover deleted files.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*/w:*'
-    Image|endswith: cipher.exe
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: administrator may execute this app to manage disk
-references:
-- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
-- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
-tags:
-  analytic_story:
-  - Ransomware
-  asset_type: Endpoint
-  confidence: 90
-  impact: 100
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors
-    of a specific disk.
-  mitre_attack_id:
-  - T1070.004
-  - T1070
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 90
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -1,76 +0,0 @@
-name: CMD Carry Out String Command Parameter
-id: 54a6ed00-3256-11ec-b031-acde48001122
-version: 3
-date: '2022-01-18'
-author: Teoderick Contreras, Bhavin Patel, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies command-line arguments where `cmd.exe
-  /c` is used to execute a program. `cmd /c` is used to run commands in MS-DOS and
-  terminate after command or process completion. This technique is commonly seen in
-  adversaries and malware to execute batch command using different shell like PowerShell
-  or different process other than `cmd.exe`. This is a good hunting query for suspicious
-  command-line made by a script or relative process execute it.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: Cmd.Exe
-  selection2:
-    Image|endswith: cmd.exe
-  selection3:
-    CommandLine: '* /c *'
-  condition: (selection1 or selection2) and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be high based on legitimate scripted code
-  in any environment. Filter as needed.
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
-tags:
-  analytic_story:
-  - Data Destruction
-  - IcedID
-  - Log4Shell CVE-2021-44228
-  - WhisperGate
-  - Hermetic Wiper
-  - Living Off The Land
-  - Azorult
-  - DarkCrystal RAT
-  - ProxyNotShell
-  - Qakbot
-  asset_type: Endpoint
-  confidence: 50
-  cve:
-  - CVE-2021-44228
-  impact: 60
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting spawn a new process.
-  mitre_attack_id:
-  - T1059.003
-  - T1059
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 30
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/cmd_echo_pipe___escalation.yml

@@ -1,78 +0,0 @@
-name: CMD Echo Pipe - Escalation
-id: eb277ba0-b96b-11eb-b00e-acde48001122
-version: 2
-date: '2021-05-20'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: This analytic identifies a common behavior by Cobalt Strike and other
-  frameworks where the adversary will escalate privileges, either via `jump` (Cobalt
-  Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will
-  look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: Cmd.Exe
-  selection2:
-    Image|endswith: cmd.exe
-  selection3:
-    CommandLine: '*%comspec%*'
-  selection4:
-    CommandLine: '*pipe*'
-  selection5:
-    CommandLine: '*echo*'
-  condition: (selection1 or selection2) or selection3 or selection4 or selection5
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Unknown. It is possible filtering may be required to ensure
-  fidelity.
-references:
-- https://redcanary.com/threat-detection-report/threats/cobalt-strike/
-- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c
-tags:
-  analytic_story:
-  - Cobalt Strike
-  asset_type: Endpoint
-  confidence: 80
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ potentially performing privilege escalation
-    using named pipes related to Cobalt Strike and other frameworks.
-  mitre_attack_id:
-  - T1059
-  - T1059.003
-  - T1543.003
-  - T1543
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 64
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -1,84 +0,0 @@
-name: Cmdline Tool Not Executed In CMD Shell
-id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
-version: 2
-date: '2022-10-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: The following analytic identifies a non-standard parent process (not
-  matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`.
-  This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also
-  typically seen when an adversary is injected into another process performing different
-  discovery techniques. This event stands out as a TTP since these tools are commonly
-  executed with a shell application or Explorer parent, and not by another application.
-  This TTP is a good indicator for an adversary gathering host information, but one
-  possible false positive might be an automated tool used by a system administator.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith:
-    - ipconfig.exe
-    - systeminfo.exe
-    - net.exe
-    - net1.exe
-    - arp.exe
-    - nslookup.exe
-    - route.exe
-    - netstat.exe
-    - whoami.exe
-  condition: (selection1)
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: A network operator or systems administrator may utilize an
-  automated host discovery application that may generate false positives. Filter as
-  needed.
-references:
-- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
-- https://attack.mitre.org/groups/G0046/
-tags:
-  analytic_story:
-  - FIN7
-  - Qakbot
-  - CISA AA22-277A
-  - Qakbot
-  asset_type: Endpoint
-  confidence: 80
-  impact: 70
-  message: A non-standard parent process $parent_process_name$ spawned child process
-    $process_name$ to execute command-line tool on $dest$.
-  mitre_attack_id:
-  - T1059
-  - T1059.007
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 56
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/conti_common_exec_parameter.yml

@@ -1,68 +0,0 @@
-name: Conti Common Exec parameter
-id: 624919bc-c382-11eb-adcc-acde48001122
-version: 1
-date: '2021-06-02'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search detects the suspicious commandline argument of revil ransomware
-  to encrypt specific or all local drive and network shares of the compromised machine
-  or host.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine:
-    - '*-m local*'
-    - '*-m net*'
-    - '*-m all*'
-    - '*-nomutex*'
-  condition: selection1
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: 3rd party tool may have commandline parameter that can trigger
-  this detection.
-references:
-- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti
-tags:
-  analytic_story:
-  - Ransomware
-  asset_type: Endpoint
-  confidence: 80
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ executing specific Conti Ransomware related
-    parameters.
-  mitre_attack_id:
-  - T1204
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 64
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/control_loading_from_world_writable_directory.yml

@@ -1,81 +0,0 @@
-name: Control Loading from World Writable Directory
-id: 10423ac4-10c9-11ec-8dc4-acde48001122
-version: 1
-date: '2021-09-08'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following detection identifies control.exe loading either a .cpl
-  or .inf from a writable directory. This is related to CVE-2021-40444. During triage,
-  review parallel processes, parent and child, for further suspicious behaviors. In
-  addition, capture file modifications and analyze.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: CONTROL.EXE
-  selection2:
-    Image|endswith: control.exe
-  selection3:
-    CommandLine:
-    - '*\\appdata\\*'
-    - '*\\windows\\temp\\*'
-    - '*\\programdata\\*'
-  condition: (selection1 or selection2) and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives will be present as control.exe does
-  not natively load from writable paths as defined. One may add .cpl or .inf to the
-  command-line if there is any false positives. Tune as needed.
-references:
-- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
-- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-- https://attack.mitre.org/techniques/T1218/011/
-- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
-tags:
-  analytic_story:
-  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 100
-  cve:
-  - CVE-2021-40444
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
-  mitre_attack_id:
-  - T1218
-  - T1218.002
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -1,84 +0,0 @@
-name: Create local admin accounts using net exe
-id: b89919ed-fe5f-492c-b139-151bb162040e
-version: 6
-date: '2021-09-08'
-author: Bhavin Patel, Splunk
-status: production
-type: TTP
-description: This search looks for the creation of local administrator accounts using
-  net.exe .
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*/add*'
-    Image|endswith:
-    - net1.exe
-    - net.exe
-  selection2:
-    CommandLine:
-    - '*administratorer*'
-    - '*amministratori*'
-    - '*administrador*'
-    - '*administrateurs*'
-    - '*administratoren*'
-    - '*administrators*'
-  condition: selection1 and selection2
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: Administrators often leverage net.exe to create admin accounts.
-references: []
-tags:
-  analytic_story:
-  - DHS Report TA18-074A
-  - Azorult
-  - CISA AA22-257A
-  asset_type: Endpoint
-  confidence: 60
-  impact: 50
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators
-    group.
-  mitre_attack_id:
-  - T1136.001
-  - T1136
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 30
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/create_or_delete_windows_shares_using_net_exe.yml

@@ -1,73 +0,0 @@
-name: Create or delete windows shares using net exe
-id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c
-version: 6
-date: '2020-09-16'
-author: Bhavin Patel, Splunk
-status: production
-type: TTP
-description: This search looks for the creation or deletion of hidden shares using
-  net.exe.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: net.exe
-  selection2:
-    Image|endswith: net.exe
-  selection3:
-    Image|endswith: net1.exe
-  selection4:
-    OriginalFileName: net1.exe
-  condition: (selection1 or selection2 or selection3 or selection4)
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Administrators often leverage net.exe to create or delete network
-  shares. You should verify that the activity was intentional and is legitimate.
-references:
-- https://attack.mitre.org/techniques/T1070/005/
-tags:
-  analytic_story:
-  - Hidden Cobra Malware
-  - CISA AA22-277A
-  - Windows Post-Exploitation
-  - Prestige Ransomware
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ enumerating Windows file shares.
-  mitre_attack_id:
-  - T1070
-  - T1070.005
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/creation_of_shadow_copy.yml

@@ -1,77 +0,0 @@
-name: Creation of Shadow Copy
-id: eb120f5f-b879-4a63-97c1-93352b5df844
-version: 1
-date: '2019-12-10'
-author: Patrick Bareiss, Splunk
-status: production
-type: TTP
-description: Monitor for signs that Vssadmin or Wmic has been used to create a shadow
-  copy.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*create*'
-    Image|endswith: vssadmin.exe
-  selection2:
-    CommandLine: '*shadow*'
-  selection3:
-    CommandLine: '*shadowcopy*'
-    Image|endswith: wmic.exe
-  selection4:
-    CommandLine: '*create*'
-  condition: (selection1 and selection2) or selection3 or selection4
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints, to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
-known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will create
-  false positives.
-references:
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
-tags:
-  analytic_story:
-  - Credential Dumping
-  asset_type: Endpoint
-  confidence: 90
-  impact: 90
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform
-    offline password cracking.
-  mitre_attack_id:
-  - T1003.003
-  - T1003
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 81
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log
-    source: crowdstrike
-    sourcetype: crowdstrike:events:sensor

dev/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml

@@ -1,78 +0,0 @@
-name: Creation of Shadow Copy with wmic and powershell
-id: 2ed8b538-d284-449a-be1d-82ad1dbd186b
-version: 3
-date: '2021-09-16'
-author: Patrick Bareiss, Splunk
-status: production
-type: TTP
-description: This search detects the use of wmic and Powershell to create a shadow
-  copy.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: wmic.exe
-  selection2:
-    Image|endswith: wmic.exe
-  selection3:
-    OriginalFileName: wmic.exe
-  selection4:
-    Image|endswith: wmic.exe
-  selection5:
-    CommandLine: '*shadowcopy*'
-  selection6:
-    CommandLine: '*create*'
-  condition: (selection1 or selection2) or selection3 or selection4 or selection5
-    or selection6
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Legtimate administrator usage of wmic to create a shadow copy.
-references:
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
-- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
-tags:
-  analytic_story:
-  - Credential Dumping
-  - Living Off The Land
-  - Volt Typhoon
-  asset_type: Endpoint
-  confidence: 90
-  impact: 90
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform
-    offline password cracking.
-  mitre_attack_id:
-  - T1003.003
-  - T1003
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 81
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml

@@ -1,72 +0,0 @@
-name: Credential Dumping via Copy Command from Shadow Copy
-id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b
-version: 2
-date: '2021-09-16'
-author: Patrick Bareiss, Splunk
-status: production
-type: TTP
-description: This search detects credential dumping using copy command from a shadow
-  copy.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: Cmd.Exe
-  selection2:
-    Image|endswith: cmd.exe
-  selection3:
-    CommandLine:
-    - '*\\system32\\config\\sam*'
-    - '*\\system32\\config\\security*'
-    - '*\\system32\\config\\system*'
-    - '*\\windows\\ntds\\ntds.dit*'
-  condition: (selection1 or selection2) and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown
-references:
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
-tags:
-  analytic_story:
-  - Credential Dumping
-  asset_type: Endpoint
-  confidence: 90
-  impact: 90
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline
-    password cracking.
-  mitre_attack_id:
-  - T1003.003
-  - T1003
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 81
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml

@@ -1,69 +0,0 @@
-name: Credential Dumping via Symlink to Shadow Copy
-id: c5eac648-fae0-4263-91a6-773df1f4c903
-version: 2
-date: '2021-09-16'
-author: Patrick Bareiss, Splunk
-status: production
-type: TTP
-description: This search detects the creation of a symlink to a shadow copy.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: Cmd.Exe
-  selection2:
-    Image|endswith: cmd.exe
-  selection3:
-    CommandLine: '*mklink*'
-  selection4:
-    CommandLine: '*HarddiskVolumeShadowCopy*'
-  condition: (selection1 or selection2) and selection3 and selection4
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown
-references:
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
-tags:
-  analytic_story:
-  - Credential Dumping
-  asset_type: Endpoint
-  confidence: 90
-  impact: 90
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy
-    to grab credentials.
-  mitre_attack_id:
-  - T1003.003
-  - T1003
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 81
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/csc_net_on_the_fly_compilation.yml

@@ -1,67 +0,0 @@
-name: CSC Net On The Fly Compilation
-id: ea73128a-43ab-11ec-9753-acde48001122
-version: 1
-date: '2021-11-12'
-author: Teoderick Contreras, Splunk
-status: production
-type: Hunting
-description: this analytic is to detect a suspicious compile before delivery approach
-  of .net compiler csc.exe. This technique was seen in several adversaries, malware
-  and even in red teams to take advantage the csc.exe .net compiler tool to compile
-  on the fly a malicious .net code to evade detection from security product. This
-  is a good hunting query to check further the file or process created after this
-  event and check the file path that passed to csc.exe which is the .net code. Aside
-  from that, powershell is capable of using this compiler in executing .net code in
-  a powershell script so filter on that case is needed.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: csc.exe
-  selection2:
-    Image|endswith: csc.exe
-  selection3:
-    CommandLine: '*/noconfig*'
-  selection4:
-    CommandLine: '*/fullpaths*'
-  selection5:
-    CommandLine: '*@*'
-  condition: (selection1 or selection2) and selection3 and selection4 and selection5
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: A network operator or systems administrator may utilize an
-  automated powershell script taht execute .net code that may generate false positive.
-  filter is needed.
-references:
-- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/
-- https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: csc.exe with commandline $process$ to compile .net code on $dest$ by $user$
-  mitre_attack_id:
-  - T1027.004
-  - T1027
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/curl_download_and_bash_execution.yml

@@ -1,72 +0,0 @@
-name: Curl Download and Bash Execution
-id: 900bc324-59f3-11ec-9fb4-acde48001122
-version: 1
-date: '2021-12-10'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies the use of curl on Linux or MacOS attempting
-  to download a file from a remote source and pipe it to bash. This is typically found
-  with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*-s *'
-    Image|endswith: curl
-  selection2:
-    CommandLine: '*bash*'
-  selection3:
-    CommandLine: '*|*'
-  condition: (selection1) or selection2 or selection3
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is
-  occurring correctly. If the EDR is not parsing the pipe bash in the command-line,
-  modifying the analytic will be required. Add parent process name (Processes.parent_process_name)
-  as needed to filter.
-known_false_positives: False positives should be limited, however filtering may be
-  required.
-references:
-- https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java
-- https://www.lunasec.io/docs/blog/log4j-zero-day/
-- https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890
-tags:
-  analytic_story:
-  - Ingress Tool Transfer
-  - Log4Shell CVE-2021-44228
-  - Linux Living Off The Land
-  asset_type: Endpoint
-  confidence: 100
-  cve:
-  - CVE-2021-44228
-  impact: 80
-  message: An instance of $process_name$ was identified on endpoint $dest$ attempting
-    to download a remote file and run it with bash.
-  mitre_attack_id:
-  - T1105
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log
-    source: Syslog:Linux-Sysmon/Operational
-    sourcetype: sysmon:linux

dev/endpoint/deleting_shadow_copies.yml

@@ -1,73 +0,0 @@
-name: Deleting Shadow Copies
-id: b89919ed-ee5f-492c-b139-95dbb162039e
-version: 4
-date: '2020-11-09'
-author: David Dorsey, Splunk
-status: production
-type: TTP
-description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy
-  Service.  Wmic is an interface to the Windows Management Instrumentation.  This
-  search looks for either of these tools being used to delete shadow copies.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*delete*'
-    Image|endswith:
-    - wmic.exe
-    - vssadmin.exe
-  selection2:
-    CommandLine: '*shadow*'
-  condition: selection1 and selection2
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
-known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped
-  with modern versions of windows. They may be used by administrators to legitimately
-  delete old backup copies, although this is typically rare.
-references: []
-tags:
-  analytic_story:
-  - Windows Log Manipulation
-  - SamSam Ransomware
-  - Ransomware
-  - Clop Ransomware
-  - CISA AA22-264A
-  - Prestige Ransomware
-  asset_type: Endpoint
-  confidence: 90
-  impact: 90
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to delete shadow copies.
-  mitre_attack_id:
-  - T1490
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 81
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_azurehound_command_line_arguments.yml

@@ -1,72 +0,0 @@
-name: Detect AzureHound Command-Line Arguments
-id: 26f02e96-c300-11eb-b611-acde48001122
-version: 1
-date: '2021-06-01'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies the common command-line argument used
-  by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may
-  be modified, but these changes are dependent upon the operator. In most instances
-  the defaults are used. This analytic works to identify the common command-line attributes
-  used. It does not cover the entirety of every argument in order to avoid false positives.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*invoke-azurehound*'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Unknown.
-references:
-- https://attack.mitre.org/software/S0521/
-- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
-- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
-- https://github.com/BloodHoundAD/Legacy-AzureHound.ps1/blob/master/AzureHound.ps1
-tags:
-  analytic_story:
-  - Discovery Techniques
-  asset_type: Endpoint
-  confidence: 100
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD.
-  mitre_attack_id:
-  - T1087.002
-  - T1069.001
-  - T1482
-  - T1087.001
-  - T1087
-  - T1069.002
-  - T1069
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_azurehound_file_modifications.yml

@@ -1,75 +0,0 @@
-name: Detect AzureHound File Modifications
-id: 1c34549e-c31b-11eb-996b-acde48001122
-version: 1
-date: '2021-06-01'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic is similar to SharpHound file modifications, but
-  this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound
-  equivilent but for Azure. It's possible this may never be seen in an environment
-  as most attackers may execute this tool remotely. Once execution is complete, a
-  zip file with a similar name will drop `20210601090751-azurecollection.zip`. In
-  addition to the zip, multiple .json files will be written to disk, which are in
-  the zip.
-data_source:
-- Sysmon Event ID 11
-search:
-  selection1:
-    Filesystem.file_name:
-    - '*-azurecollection.zip'
-    - '*-azprivroleadminrights.json'
-    - '*-azglobaladminrights.json'
-    - '*-azcloudappadmins.json'
-    - '*-azapplicationadmins.json'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on file modifications that include the name of the process, and file, responsible
-  for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem`
-  node.
-known_false_positives: False positives should be limited as the analytic is specific
-  to a filename with extension .zip. Filter as needed.
-references:
-- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
-- https://github.com/BloodHoundAD/Legacy-AzureHound.ps1/blob/master/AzureHound.ps1
-tags:
-  analytic_story:
-  - Discovery Techniques
-  asset_type: Endpoint
-  confidence: 90
-  impact: 70
-  message: A file - $file_name$ was written to disk that is related to AzureHound,
-    a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$.
-  mitre_attack_id:
-  - T1087.002
-  - T1069.001
-  - T1482
-  - T1087.001
-  - T1087
-  - T1069.002
-  - T1069
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: file_name
-    type: File Name
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 63
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_exchange_web_shell.yml

@@ -1,86 +0,0 @@
-name: Detect Exchange Web Shell
-id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
-version: 4
-date: '2022-09-30'
-author: Michael Haag, Shannon Davis, David Dorsey, Splunk
-status: production
-type: TTP
-description: 'The following query identifies suspicious .aspx created in 3 paths identified
-  by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM
-  group and recently disclosed vulnerablity named ProxyShell and ProxyNotShell. Paths
-  include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`.
-  Upon triage, the suspicious .aspx file will likely look obvious on the surface.
-  inspect the contents for script code inside. Identify additional log sources, IIS
-  included, to review source and other potential exploitation. It is often the case
-  that a particular threat is only applicable to a specific subset of systems in your
-  environment. Typically analytics to detect those threats are written without the
-  benefit of being able to only target those systems as well. Writing analytics against
-  all systems when those behaviors are limited to identifiable subsets of those systems
-  is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange
-  Servers. With asset information, a hunter can limit their analytics to systems that
-  have been identified as Exchange servers. A hunter may start with the theory that
-  the exchange server is communicating with new systems that it has not previously.
-  If this theory is run against all publicly facing systems, the amount of noise it
-  will generate will likely render this theory untenable. However, using the asset
-  information to limit this analytic to just the Exchange servers will reduce the
-  noise allowing the hunter to focus only on the systems where this behavioral change
-  is relevant.'
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith: System
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
-  node.
-known_false_positives: The query is structured in a way that `action` (read, create)
-  is not defined. Review the results of this query, filter, and tune as necessary.
-  It may be necessary to generate this query specific to your endpoint product.
-references:
-- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
-- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
-- https://www.youtube.com/watch?v=FC6iHw258RI
-- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
-tags:
-  analytic_story:
-  - HAFNIUM Group
-  - ProxyShell
-  - CISA AA22-257A
-  - ProxyNotShell
-  asset_type: Endpoint
-  confidence: 90
-  impact: 90
-  message: A file - $file_name$ was written to disk that is related to IIS exploitation
-    previously performed by HAFNIUM. Review further file modifications on endpoint
-    $dest$ by user $user$.
-  mitre_attack_id:
-  - T1505
-  - T1505.003
-  - T1190
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: file_name
-    type: File Name
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 81
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_html_help_renamed.yml

@@ -1,77 +0,0 @@
-name: Detect HTML Help Renamed
-id: 62fed254-513b-460e-953d-79771493a9f3
-version: 4
-date: '2022-04-07'
-author: Michael Haag, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies a renamed instance of hh.exe (HTML
-  Help) executing a Compiled HTML Help (CHM). This particular technique will load
-  Windows script code from a compiled help file. CHM files may contain nearly any
-  file type embedded, but only execute html/htm. Upon a successful execution, the
-  following script engines may be used for execution - JScript, VBScript, VBScript.Encode,
-  JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll
-  loading into hh.exe upon execution. The "htm" and "html" file extensions were the
-  only extensions observed to be supported for the execution of Shortcut commands
-  or WSH script code. During investigation, identify script content origination. Validate
-  it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively
-  found in C:\Windows\system32 and C:\Windows\syswow64.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: HH.EXE
-    Image|endswith: hh.exe
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely a renamed instance of hh.exe will be used
-  legitimately, filter as needed.
-references:
-- https://attack.mitre.org/techniques/T1218/001/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
-- https://lolbas-project.github.io/lolbas/Binaries/Hh/
-tags:
-  analytic_story:
-  - Suspicious Compiled HTML Activity
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 100
-  impact: 80
-  message: The following $process_name$ has been identified as renamed, spawning from
-    $parent_process_name$.
-  mitre_attack_id:
-  - T1218
-  - T1218.001
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: Computer
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_html_help_spawn_child_process.yml

@@ -1,78 +0,0 @@
-name: Detect HTML Help Spawn Child Process
-id: 723716de-ee55-4cd4-9759-c44e7e55ba4b
-version: 1
-date: '2021-02-11'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
-  HTML Help (CHM) that spawns a child process. This particular technique will load
-  Windows script code from a compiled help file. CHM files may contain nearly any
-  file type embedded, but only execute html/htm. Upon a successful execution, the
-  following script engines may be used for execution - JScript, VBScript, VBScript.Encode,
-  JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll
-  loading into hh.exe upon execution. The "htm" and "html" file extensions were the
-  only extensions observed to be supported for the execution of Shortcut commands
-  or WSH script code. During investigation, identify script content origination. Review
-  child process events and investigate further. hh.exe is natively found in C:\Windows\system32
-  and C:\Windows\syswow64.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    ParentImage: hh.exe
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Although unlikely, some legitimate applications (ex. web browsers)
-  may spawn a child process. Filter as needed.
-references:
-- https://attack.mitre.org/techniques/T1218/001/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
-- https://lolbas-project.github.io/lolbas/Binaries/Hh/
-- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
-- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
-tags:
-  analytic_story:
-  - Suspicious Compiled HTML Activity
-  - Living Off The Land
-  - AgentTesla
-  asset_type: Endpoint
-  confidence: 100
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ spawning a child process, typically not normal
-    behavior.
-  mitre_attack_id:
-  - T1218
-  - T1218.001
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_html_help_url_in_command_line.yml

@@ -1,84 +0,0 @@
-name: Detect HTML Help URL in Command Line
-id: 8c5835b9-39d9-438b-817c-95f14c69a31e
-version: 2
-date: '2021-09-16'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
-  HTML Help (CHM) file from a remote url. This particular technique will load Windows
-  script code from a compiled help file. CHM files may  contain nearly any file type
-  embedded, but only execute html/htm. Upon a successful execution, the following
-  script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode,
-  JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe
-  upon execution. The "htm" and "html" file extensions were the only extensions observed
-  to be supported for the execution of Shortcut commands or WSH script code. During
-  investigation, identify script content origination. Review reputation of remote
-  IP and domain. Some instances, it is worth decompiling the .chm file to review its
-  original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: HH.EXE
-  selection2:
-    Image|endswith: hh.exe
-  selection3:
-    CommandLine: '*http*'
-  condition: (selection1 or selection2) and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, some legitimate applications may retrieve
-  a CHM remotely, filter as needed.
-references:
-- https://attack.mitre.org/techniques/T1218/001/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
-- https://lolbas-project.github.io/lolbas/Binaries/Hh/
-- https://blog.sevagas.com/?Hacking-around-HTA-files
-- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
-- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
-tags:
-  analytic_story:
-  - Suspicious Compiled HTML Activity
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 100
-  impact: 90
-  message: An instance of $parent_proces_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ contacting a remote destination to potentally
-    download a malicious payload.
-  mitre_attack_id:
-  - T1218
-  - T1218.001
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 90
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_html_help_using_infotech_storage_handlers.yml

@@ -1,83 +0,0 @@
-name: Detect HTML Help Using InfoTech Storage Handlers
-id: 0b2eefa5-5508-450d-b970-3dd2fb761aec
-version: 2
-date: '2021-09-16'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
-  HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
-  will load Windows script code from a compiled help file, using InfoTech Storage
-  Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are
-  supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm
-  file from within a CHM file. CHM files may contain nearly any file type embedded.
-  Upon a successful execution, the following script engines may be used for execution
-  - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may
-  identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm"
-  and "html" file extensions were the only extensions observed to be supported for
-  the execution of Shortcut commands or WSH script code. During investigation, identify
-  script content origination. hh.exe is natively found in C:\Windows\system32 and
-  C:\Windows\syswow64.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: HH.EXE
-  selection2:
-    Image|endswith: hh.exe
-  selection3:
-    CommandLine:
-    - '*its:*'
-    - '*mk:@MSITStore:*'
-  condition: (selection1 or selection2) and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
-  used, but it does happen in some legitimate instances. Filter as needed.
-references:
-- https://attack.mitre.org/techniques/T1218/001/
-- https://www.kb.cert.org/vuls/id/851869
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
-- https://lolbas-project.github.io/lolbas/Binaries/Hh/
-- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
-- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
-tags:
-  analytic_story:
-  - Suspicious Compiled HTML Activity
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 90
-  impact: 80
-  message: $process_name$ has been identified using Infotech Storage Handlers to load
-    a specific file within a CHM on $dest$ under user $user$.
-  mitre_attack_id:
-  - T1218
-  - T1218.001
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 72
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_mshta_inline_hta_execution.yml

@@ -1,78 +0,0 @@
-name: Detect mshta inline hta execution
-id: a0873b32-5b68-11eb-ae93-0242ac130002
-version: 6
-date: '2021-09-16'
-author: Bhavin Patel, Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies "mshta.exe" execution with inline protocol
-  handlers. "JavaScript", "VBScript", and "About" are the only supported options when
-  invoking HTA content directly on the command-line. The search will return the first
-  time and last time these command-line arguments were used for these executions,
-  as well as the target system, the user, process "mshta.exe" and its parent process.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: MSHTA.EXE
-  selection2:
-    Image|endswith: mshta.exe
-  selection3:
-    CommandLine:
-    - '*vbscript*'
-    - '*javascript*'
-    - '*about*'
-  condition: (selection1 or selection2) and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, some legitimate applications may exhibit
-  this behavior, triggering a false positive.
-references:
-- https://github.com/redcanaryco/AtomicTestHarnesses
-- https://redcanary.com/blog/introducing-atomictestharnesses/
-- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
-tags:
-  analytic_story:
-  - Suspicious MSHTA Activity
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 100
-  impact: 90
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense
-    evasion.
-  mitre_attack_id:
-  - T1218
-  - T1218.005
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 90
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_mshta_renamed.yml

@@ -1,70 +0,0 @@
-name: Detect mshta renamed
-id: 8f45fcf0-5b68-11eb-ae93-0242ac130002
-version: 3
-date: '2022-04-07'
-author: Michael Haag, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies renamed instances of mshta.exe executing.
-  Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This
-  analytic utilizes the internal name of the PE to identify if is the legitimate mshta
-  binary. Further analysis should be performed to review the executed content and
-  validation it is the real mshta.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: MSHTA.EXE
-    Image|endswith: mshta.exe
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, some legitimate applications may use a moved
-  copy of mshta.exe, but never renamed, triggering a false positive.
-references:
-- https://github.com/redcanaryco/AtomicTestHarnesses
-- https://redcanary.com/blog/introducing-atomictestharnesses/
-tags:
-  analytic_story:
-  - Suspicious MSHTA Activity
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 100
-  impact: 80
-  message: The following $process_name$ has been identified as renamed, spawning from
-    $parent_process_name$.
-  mitre_attack_id:
-  - T1218
-  - T1218.005
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: Computer
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_mshta_url_in_command_line.yml

@@ -1,79 +0,0 @@
-name: Detect MSHTA Url in Command Line
-id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
-version: 2
-date: '2021-09-16'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
-  utility is used to make remote http connections. Adversaries may use mshta.exe to
-  proxy the download and execution of remote .hta files. The analytic identifies command
-  line arguments of http and https being used. This technique is commonly used by
-  malicious software to bypass preventative controls. The search will return the first
-  time and last time these command-line arguments were used for these executions,
-  as well as the target system, the user, process "rundll32.exe" and its parent process.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: MSHTA.EXE
-  selection2:
-    Image|endswith: mshta.exe
-  selection3:
-    CommandLine:
-    - '*http://*'
-    - '*https://*'
-  condition: (selection1 or selection2) and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: It is possible legitimate applications may perform this behavior
-  and will need to be filtered.
-references:
-- https://github.com/redcanaryco/AtomicTestHarnesses
-- https://redcanary.com/blog/introducing-atomictestharnesses/
-- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
-tags:
-  analytic_story:
-  - Suspicious MSHTA Activity
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 100
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $est$ by user $user$ attempting to access a remote destination to
-    download an additional payload.
-  mitre_attack_id:
-  - T1218
-  - T1218.005
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_outlook_exe_writing_a_zip_file.yml

@@ -1,49 +0,0 @@
-name: Detect Outlook exe writing a zip file
-id: a51bfe1a-94f0-4822-b1e4-16ae10145893
-version: 3
-date: '2020-07-21'
-author: Bhavin Patel, Splunk
-status: experimental
-type: TTP
-description: This search looks for execution of process `outlook.exe` where the process
-  is writing a `.zip` file to the disk.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith:
-    - outlook.exe
-    - explorer.exe
-  condition: selection1
-how_to_implement: You must be ingesting data that records filesystem and process activity
-  from your hosts to populate the Endpoint data model. This is typically populated
-  via endpoint detection-and-response product, such as Carbon Black, or endpoint data
-  sources, such as Sysmon.
-known_false_positives: It is not uncommon for outlook to write legitimate zip files
-  to the disk.
-references: []
-tags:
-  analytic_story:
-  - Spearphishing Attachments
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: tbd
-  mitre_attack_id:
-  - T1566
-  - T1566.001
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: network

dev/endpoint/detect_path_interception_by_creation_of_program_exe.yml

@@ -1,65 +0,0 @@
-name: Detect Path Interception By Creation Of program exe
-id: cbef820c-e1ff-407f-887f-0a9240a2d477
-version: 3
-date: '2020-07-03'
-author: Patrick Bareiss, Splunk
-status: production
-type: TTP
-description: 'The detection Detect Path Interception By Creation Of program exe is
-  detecting the abuse of unquoted service paths, which is a popular technique for
-  privilege escalation. '
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    ParentImage: services.exe
-  condition: selection1
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: unknown
-references:
-- https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
-tags:
-  analytic_story:
-  - Windows Persistence Techniques
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to perform privilege escalation by
-    using unquoted service paths.
-  mitre_attack_id:
-  - T1574.009
-  - T1574
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml

@@ -1,73 +0,0 @@
-name: Detect Prohibited Applications Spawning cmd exe
-id: dcfd6b40-42f9-469d-a433-2e53f7486664
-version: 6
-date: '2020-11-10'
-author: Bhavin Patel, Splunk
-status: production
-type: Hunting
-description: This search looks for executions of cmd.exe spawned by a process that
-  is often abused by attackers and that does not typically launch cmd.exe.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: Cmd.Exe
-  selection2:
-    Image|endswith: cmd.exe
-  condition: (selection1 or selection2)
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts and populates the Endpoint data model with the resultant dataset. This search
-  includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list
-  of processes that should not be spawning cmd.exe. You can modify this lookup to
-  better suit your environment. To successfully implement this search you need to
-  be ingesting information on process that include the name of the process responsible
-  for the changes from your endpoints into the `Endpoint` datamodel in the `Processes`
-  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
-  latest TA for the endpoint product.
-known_false_positives: There are circumstances where an application may legitimately
-  execute and interact with the Windows command-line interface. Investigate and modify
-  the lookup file, as appropriate.
-references: []
-tags:
-  analytic_story:
-  - Suspicious Command-Line Executions
-  - Suspicious MSHTA Activity
-  - Suspicious Zoom Child Processes
-  - NOBELIUM Group
-  asset_type: Endpoint
-  confidence: 100
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ running prohibited applications.
-  mitre_attack_id:
-  - T1059
-  - T1059.003
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: Computer
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_rclone_command_line_usage.yml

@@ -1,88 +0,0 @@
-name: Detect RClone Command-Line Usage
-id: 32e0baea-b3f1-11eb-a2ce-acde48001122
-version: 2
-date: '2021-11-29'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: This analytic identifies commonly used command-line arguments used by
-  `rclone.exe` to initiate a file transfer. Some arguments were negated as they are
-  specific to the configuration used by adversaries. In particular, an adversary may
-  list the files or directories of the remote file share using `ls` or `lsd`, which
-  is not indicative of malicious behavior. During triage, at this stage of a ransomware
-  event, exfiltration is about to occur or has already. Isolate the endpoint and continue
-  investigating by review file modifications and parallel processes.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith: rclone.exe
-  selection2:
-    OriginalFileName: rclone.exe
-  selection3:
-    CommandLine:
-    - '*copy*'
-    - '*mega*'
-    - '*pcloud*'
-    - '*ftp*'
-    - '*--config*'
-    - '*--progress*'
-    - '*--no-check-certificate*'
-    - '*--ignore-existing*'
-    - '*--auto-confirm*'
-    - '*--transfers*'
-    - '*--multi-thread-streams*'
-  condition: (selection1 or selection2) and selection3
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited as this is restricted to
-  the Rclone process name. Filter or tune the analytic as needed.
-references:
-- https://redcanary.com/blog/rclone-mega-extortion/
-- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
-- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
-- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
-tags:
-  analytic_story:
-  - DarkSide Ransomware
-  - Ransomware
-  asset_type: Endpoint
-  confidence: 70
-  impact: 50
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service
-    to move files or folders.
-  mitre_attack_id:
-  - T1020
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 35
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_regasm_spawning_a_process.yml

@@ -1,74 +0,0 @@
-name: Detect Regasm Spawning a Process
-id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f
-version: 1
-date: '2021-02-12'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies regasm.exe spawning a process. This
-  particular technique has been used in the wild to bypass application control products.
-  Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process
-  is rare from either process and should be investigated further. During investigation,
-  identify and retrieve the content being loaded. Review parallel processes for additional
-  suspicious behavior. Gather any other file modifications and review accordingly.
-  regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
-  and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    ParentImage: regasm.exe
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe
-  may cause a false positive. Filter based endpoint usage, command line arguments,
-  or process lineage.
-references:
-- https://attack.mitre.org/techniques/T1218/009/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
-- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
-- https://lolbas-project.github.io/lolbas/Binaries/Regasm/
-tags:
-  analytic_story:
-  - Suspicious Regsvcs Regasm Activity
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 80
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ spawning a child process, typically not normal
-    behavior for $parent_process_name$.
-  mitre_attack_id:
-  - T1218
-  - T1218.009
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 64
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_regasm_with_no_command_line_arguments.yml

@@ -1,74 +0,0 @@
-name: Detect Regasm with no Command Line Arguments
-id: c3bc1430-04e7-4178-835f-047d8e6e97df
-version: 3
-date: '2022-03-15'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies regasm.exe with no command line arguments.
-  This particular behavior occurs when another process injects into regasm.exe, no
-  command line arguments will be present. During investigation, identify any network
-  connections and parallel processes. Identify any suspicious module loads related
-  to credential dumping or file writes. Regasm.exe are natively found in `C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe`
-  and `C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe`.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: RegAsm.exe
-  selection2:
-    Image|endswith: regasm.exe
-  condition: (selection1 or selection2)
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, limited instances of regasm.exe or may cause
-  a false positive. Filter based endpoint usage, command line arguments, or process
-  lineage.
-references:
-- https://attack.mitre.org/techniques/T1218/009/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
-- https://lolbas-project.github.io/lolbas/Binaries/Regasm/
-tags:
-  analytic_story:
-  - Suspicious Regsvcs Regasm Activity
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: The process $process_name$ was spawned by $parent_process_name$ without
-    any command-line arguments on $dest$ by $user$.
-  mitre_attack_id:
-  - T1218
-  - T1218.009
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_regsvcs_spawning_a_process.yml

@@ -1,72 +0,0 @@
-name: Detect Regsvcs Spawning a Process
-id: bc477b57-5c21-4ab6-9c33-668772e7f114
-version: 1
-date: '2021-02-12'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies regsvcs.exe spawning a process. This
-  particular technique has been used in the wild to bypass application control products.
-  Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process
-  is rare from either process and should be investigated further. During investigation,
-  identify and retrieve the content being loaded. Review parallel processes for additional
-  suspicious behavior. Gather any other file modifications and review accordingly.
-  regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
-  and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    ParentImage: regsvcs.exe
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe
-  may cause a false positive. Filter based endpoint usage, command line arguments,
-  or process lineage.
-references:
-- https://attack.mitre.org/techniques/T1218/009/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
-- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
-tags:
-  analytic_story:
-  - Suspicious Regsvcs Regasm Activity
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 80
-  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$  was identified
-    on endpoint $dest$ by user $user$ typically not normal for this process.
-  mitre_attack_id:
-  - T1218
-  - T1218.009
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 64
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_regsvcs_with_no_command_line_arguments.yml

@@ -1,74 +0,0 @@
-name: Detect Regsvcs with No Command Line Arguments
-id: 6b74d578-a02e-4e94-a0d1-39440d0bf254
-version: 3
-date: '2022-03-15'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies regsvcs.exe with no command line arguments.
-  This particular behavior occurs when another process injects into regsvcs.exe, no
-  command line arguments will be present. During investigation, identify any network
-  connections and parallel processes. Identify any suspicious module loads related
-  to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
-  and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: RegSvcs.exe
-  selection2:
-    Image|endswith: regsvcs.exe
-  condition: (selection1 or selection2)
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause
-  a false positive. Filter based endpoint usage, command line arguments, or process
-  lineage.
-references:
-- https://attack.mitre.org/techniques/T1218/009/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
-- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
-tags:
-  analytic_story:
-  - Suspicious Regsvcs Regasm Activity
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: The process $process_name$ was spawned by $parent_process_name$ without
-    any command-line arguments on $dest$ by $user$.
-  mitre_attack_id:
-  - T1218
-  - T1218.009
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_renamed_7_zip.yml

@@ -1,67 +0,0 @@
-name: Detect Renamed 7-Zip
-id: 4057291a-b8cf-11eb-95fe-acde48001122
-version: 2
-date: '2021-09-16'
-author: Michael Haag, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies renamed 7-Zip usage using Sysmon. At
-  this stage of an attack, review parallel processes and file modifications for data
-  that is staged or potentially have been exfiltrated. This analytic utilizes the
-  OriginalFileName to capture the renamed process. During triage, validate this is
-  the legitimate version of `7zip` by reviewing the PE metadata. In addition, review
-  parallel processes for further suspicious behavior.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith: 7z*.exe
-    OriginalFileName: 7z*.exe
-  condition: (selection1)
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Limited false positives, however this analytic will need to
-  be modified for each environment if Sysmon is not used.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
-tags:
-  analytic_story:
-  - Collection and Staging
-  asset_type: Endpoint
-  confidence: 90
-  impact: 30
-  message: The following $process_name$ has been identified as renamed, spawning from
-    $parent_process_name$ on $dest$ by $user$.
-  mitre_attack_id:
-  - T1560.001
-  - T1560
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 27
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_renamed_psexec.yml

@@ -1,76 +0,0 @@
-name: Detect Renamed PSExec
-id: 683e6196-b8e8-11eb-9a79-acde48001122
-version: 4
-date: '2022-04-07'
-author: Michael Haag, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies renamed instances of `PsExec.exe` being
-  utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe`
-  or other SysInternal utility usage with the command-line argument of `-accepteula`.
-  During triage, validate this is the legitimate version of `PsExec` by reviewing
-  the PE metadata. In addition, review parallel processes for further suspicious behavior.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: psexec.c
-    Image|endswith:
-    - psexec64.exe
-    - psexec.exe
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives should be present. It is possible some
-  third party applications may use older versions of PsExec, filter as needed.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml
-- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
-tags:
-  analytic_story:
-  - SamSam Ransomware
-  - DHS Report TA18-074A
-  - HAFNIUM Group
-  - DarkSide Ransomware
-  - Active Directory Lateral Movement
-  - CISA AA22-320A
-  asset_type: Endpoint
-  confidence: 90
-  impact: 30
-  message: The following $process_name$ has been identified as renamed, spawning from
-    $parent_process_name$ on $dest$ by $user$.
-  mitre_attack_id:
-  - T1569
-  - T1569.002
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 27
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_renamed_rclone.yml

@@ -1,72 +0,0 @@
-name: Detect Renamed RClone
-id: 6dca1124-b3ec-11eb-9328-acde48001122
-version: 2
-date: '2021-09-16'
-author: Michael Haag, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies the usage of `rclone.exe`, renamed,
-  being used to exfiltrate data to a remote destination. RClone has been used by multiple
-  ransomware groups to exfiltrate data. In many instances, it will be downloaded from
-  the legitimate site and executed accordingly. During triage, isolate the endpoint
-  and begin to review parallel processes for additional behavior. At this stage, the
-  adversary may have staged data to be exfiltrated.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith: rclone.exe
-    OriginalFileName: rclone.exe
-  condition: (selection1)
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited as this analytic identifies
-  renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business
-  use case.
-references:
-- https://redcanary.com/blog/rclone-mega-extortion/
-- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
-- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
-tags:
-  analytic_story:
-  - DarkSide Ransomware
-  - Ransomware
-  asset_type: Endpoint
-  confidence: 90
-  impact: 30
-  message: The following $process_name$ has been identified as renamed, spawning from
-    $parent_process_name$ on $dest$ by $user$.
-  mitre_attack_id:
-  - T1020
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 27
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_renamed_winrar.yml

@@ -1,71 +0,0 @@
-name: Detect Renamed WinRAR
-id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
-version: 3
-date: '2021-09-16'
-author: Michael Haag, Splunk
-status: production
-type: Hunting
-description: The following analtyic identifies renamed instances of `WinRAR.exe`.
-  In most cases, it is not common for WinRAR to be used renamed, however it is common
-  to be installed by a third party application and executed from a non-standard path.
-  During triage, validate additional metadata from the binary that this is `WinRAR`.
-  Review parallel processes and file modifications.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith:
-    - winrar.exe
-    - rar.exe
-    OriginalFileName: WinRAR.exe
-  condition: (selection1)
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Unknown. It is possible third party applications use renamed
-  instances of WinRAR.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
-tags:
-  analytic_story:
-  - Collection and Staging
-  - CISA AA22-277A
-  asset_type: Endpoint
-  confidence: 90
-  impact: 30
-  message: The following $process_name$ has been identified as renamed, spawning from
-    $parent_process_name$ on $dest$ by $user$.
-  mitre_attack_id:
-  - T1560.001
-  - T1560
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 27
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_sharphound_command_line_arguments.yml

@@ -1,65 +0,0 @@
-name: Detect SharpHound Command-Line Arguments
-id: a0bdd2f6-c2ff-11eb-b918-acde48001122
-version: 1
-date: '2021-06-01'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies common command-line arguments used
-  by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS,
-  function names may be modified, but these changes are dependent upon the operator.
-  In most instances the defaults are used. This analytic works to identify the common
-  command-line attributes used. It does not cover the entirety of every argument in
-  order to avoid false positives.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine:
-    - '*-collectionMethod*'
-    - '*invoke-bloodhound*'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: False positives should be limited as the arguments used are
-  specific to SharpHound. Filter as needed or add more command-line arguments as needed.
-references:
-- https://attack.mitre.org/software/S0521/
-- https://thedfirreport.com/?s=bloodhound
-- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
-- https://github.com/BloodHoundAD/SharpHound3
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
-tags:
-  analytic_story:
-  - Discovery Techniques
-  - Ransomware
-  asset_type: Endpoint
-  confidence: 80
-  impact: 30
-  message: Possible SharpHound command-Line arguments identified on $dest$
-  mitre_attack_id:
-  - T1087.002
-  - T1069.001
-  - T1482
-  - T1087.001
-  - T1087
-  - T1069.002
-  - T1069
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 24
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_sharphound_file_modifications.yml

@@ -1,84 +0,0 @@
-name: Detect SharpHound File Modifications
-id: 42b4b438-beed-11eb-ba1d-acde48001122
-version: 2
-date: '2022-10-09'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound.
-  SharpHound will query the domain controller and begin gathering all the data related
-  to the domain and trusts. For output, it will drop a .zip file upon completion following
-  a typical pattern that is often not changed. This analytic focuses on the default
-  file name scheme. Note that this may be evaded with different parameters within
-  SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip`
-  are two examples. In addition, executing SharpHound via .exe or .ps1 without any
-  command-line arguments will still perform activity and dump output to the default
-  filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates
-  multiple temp files following the same pattern `20210601182121_computers.json`,
-  `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required,
-  or remove these json's entirely if it is too noisy. During traige, review parallel
-  processes for further suspicious behavior. Typically, the process executing the
-  `.ps1` ingestor will be PowerShell.
-data_source:
-- Sysmon Event ID 11
-search:
-  selection1:
-    Filesystem.file_name:
-    - '*bloodhound.zip'
-    - '*_computers.json'
-    - '*_gpos.json'
-    - '*_domains.json'
-    - '*_users.json'
-    - '*_groups.json'
-    - '*_ous.json'
-    - '*_containers.json'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on file modifications that include the name of the process, and file, responsible
-  for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem`
-  node.
-known_false_positives: False positives should be limited as the analytic is specific
-  to a filename with extension .zip. Filter as needed.
-references:
-- https://attack.mitre.org/software/S0521/
-- https://thedfirreport.com/?s=bloodhound
-- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
-- https://github.com/BloodHoundAD/SharpHound3
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
-tags:
-  analytic_story:
-  - Discovery Techniques
-  - Ransomware
-  asset_type: Endpoint
-  confidence: 80
-  impact: 30
-  message: Potential SharpHound file modifications identified on $dest$
-  mitre_attack_id:
-  - T1087.002
-  - T1069.001
-  - T1482
-  - T1087.001
-  - T1087
-  - T1069.002
-  - T1069
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: User
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 24
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_sharphound_usage.yml

@@ -1,69 +0,0 @@
-name: Detect SharpHound Usage
-id: dd04b29a-beed-11eb-87bc-acde48001122
-version: 2
-date: '2021-05-27'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies SharpHound binary usage by using the
-  original filena,e. In addition to renaming the PE, other coverage is available to
-  detect command-line arguments. This particular analytic looks for the original_file_name
-  of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe
-  have different original filenames. Dependent upon the operator, the code may be
-  re-compiled and the attributes removed or changed to anything else. During triage,
-  review the metadata of the binary in question. Review parallel processes for suspicious
-  behavior. Identify the source of this binary.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: SharpHound.exe
-  selection2:
-    Image|endswith: sharphound.exe
-  condition: (selection1 or selection2)
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited as this is specific to a
-  file attribute not used by anything else. Filter as needed.
-references:
-- https://attack.mitre.org/software/S0521/
-- https://thedfirreport.com/?s=bloodhound
-- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
-- https://github.com/BloodHoundAD/SharpHound3
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
-tags:
-  analytic_story:
-  - Discovery Techniques
-  - Ransomware
-  asset_type: Endpoint
-  confidence: 80
-  impact: 30
-  message: Potential SharpHound binary identified on $dest$
-  mitre_attack_id:
-  - T1087.002
-  - T1069.001
-  - T1482
-  - T1087.001
-  - T1087
-  - T1069.002
-  - T1069
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 24
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml

@@ -1,55 +0,0 @@
-name: Detect Use of cmd exe to Launch Script Interpreters
-id: b89919ed-fe5f-492c-b139-95dbb162039e
-version: 4
-date: '2020-07-21'
-author: Bhavin Patel, Mauricio Velazco, Splunk
-status: production
-type: TTP
-description: This search looks for the execution of the cscript.exe or wscript.exe
-  processes, with a parent of cmd.exe. The search will return the count, the first
-  and last time this execution was seen on a machine, the user, and the destination
-  of the machine
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith:
-    - wscript.exe
-    - cscript.exe
-    ParentImage: cmd.exe
-  condition: (selection1)
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
-  of the Sysmon TA.
-known_false_positives: Some legitimate applications may exhibit this behavior.
-references: []
-tags:
-  analytic_story:
-  - 'Emotet Malware  DHS Report TA18-201A '
-  - Suspicious Command-Line Executions
-  - Azorult
-  asset_type: Endpoint
-  confidence: 50
-  impact: 70
-  message: cmd.exe launching script interpreters on $dest$
-  mitre_attack_id:
-  - T1059
-  - T1059.003
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 35
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/detection_of_tools_built_by_nirsoft.yml

@@ -1,45 +0,0 @@
-name: Detection of tools built by NirSoft
-id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0
-version: 3
-date: '2020-07-21'
-author: Bhavin Patel, Splunk
-status: experimental
-type: TTP
-description: This search looks for specific command-line arguments that may indicate
-  the execution of tools made by Nirsoft, which are legitimate, but may be abused
-  by attackers.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine:
-    - '* /stext *'
-    - '* /scomma *'
-  condition: (selection1)
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
-known_false_positives: While legitimate, these NirSoft tools are prone to abuse. You
-  should verfiy that the tool was used for a legitimate purpose.
-references: []
-tags:
-  analytic_story:
-  - 'Emotet Malware  DHS Report TA18-201A '
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: tbd
-  mitre_attack_id:
-  - T1072
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint

dev/endpoint/disable_amsi_through_registry.yml

@@ -1,55 +0,0 @@
-name: Disable AMSI Through Registry
-id: 9c27ec42-d338-11eb-9044-acde48001122
-version: 2
-date: '2022-01-26'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: this search is to identify modification in registry to disable AMSI windows
-  feature to evade detections. This technique was seen in several ransomware, RAT
-  and even APT to impaire defenses of the compromise machine and to be able to execute
-  payload with minimal alert as much as possible.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000000'
-    TargetObject: '*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: network operator may disable this feature of windows but not
-  so common.
-references:
-- https://blog.f-secure.com/hunting-for-amsi-bypasses/
-- https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9
-tags:
-  analytic_story:
-  - Ransomware
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: Disable AMSI Through Registry
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25.0
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_defender_blockatfirstseen_feature.yml

@@ -1,59 +0,0 @@
-name: Disable Defender BlockAtFirstSeen Feature
-id: 2dd719ac-3021-11ec-97b4-acde48001122
-version: 2
-date: '2022-01-26'
-author: Teoderick Contreras
-status: production
-type: TTP
-description: This analytic is intended to detect a suspicious modification of the
-  Windows registry to disable a Windows Defender feature. This technique is intended
-  to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen
-  feature where it blocks suspicious files the first time seen on the host.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Registry.registry_value_name: DisableBlockAtFirstSeen
-    TargetObject: '*\\Microsoft\\Windows Defender\\SpyNet*'
-    Details: '0x00000001'
-  condition: selection1
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin or user may choose to disable windows defender product
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
-tags:
-  analytic_story:
-  - IcedID
-  - Windows Registry Abuse
-  - Azorult
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: modified/added/deleted registry entry $registry_path$ in $dest$
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_defender_enhanced_notification.yml

@@ -1,59 +0,0 @@
-name: Disable Defender Enhanced Notification
-id: dc65678c-301f-11ec-8e30-acde48001122
-version: 2
-date: '2022-01-26'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic is intended to detect a suspicious modification of registry
-  to disable windows defender features. This technique attempts to bypass or evade
-  detection from Windows Defender AV, specifically the Enhanced Notification feature
-  where a user or admin would receive alerts.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Registry.registry_value_name: DisableEnhancedNotifications
-    TargetObject: '*Microsoft\\Windows Defender\\Reporting*'
-    Details: '0x00000001'
-  condition: selection1
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data executions
-  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4
-  of the Sysmon TA.
-known_false_positives: user may choose to disable windows defender AV
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
-tags:
-  analytic_story:
-  - IcedID
-  - Windows Registry Abuse
-  - Azorult
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: modified/added/deleted registry entry $registry_path$ in $dest$
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_defender_mpengine_registry.yml

@@ -1,59 +0,0 @@
-name: Disable Defender MpEngine Registry
-id: cc391750-3024-11ec-955a-acde48001122
-version: 2
-date: '2022-01-26'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This particular behavior is typically executed when an adversary or malware
-  gains access to an endpoint and begins to perform execution and to evade detections.
-  Usually, a batch (.bat) file will be executed and multiple registry and scheduled
-  task modifications will occur. During triage, review parallel processes and identify
-  any further file modifications. Endpoint should be isolated.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Registry.registry_value_name: MpEnablePus
-    TargetObject: '*\\Policies\\Microsoft\\Windows Defender\\MpEngine*'
-    Details: '0x00000000'
-  condition: selection1
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin or user may choose to disable windows defender product
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
-tags:
-  analytic_story:
-  - IcedID
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: modified/added/deleted registry entry $registry_path$ in $dest$
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_defender_spynet_reporting.yml

@@ -1,60 +0,0 @@
-name: Disable Defender Spynet Reporting
-id: 898debf4-3021-11ec-ba7c-acde48001122
-version: 2
-date: '2022-01-26'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic is intended to detect a suspicious modification of registry
-  to disable Windows Defender feature. This technique is intended to bypass or evade
-  detection from Windows Defender AV product, specifically the spynet reporting for
-  Defender telemetry.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Registry.registry_value_name: SpynetReporting
-    TargetObject: '*\\Microsoft\\Windows Defender\\SpyNet*'
-    Details: '0x00000000'
-  condition: selection1
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin or user may choose to disable windows defender product
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
-tags:
-  analytic_story:
-  - IcedID
-  - Windows Registry Abuse
-  - Azorult
-  - Qakbot
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: modified/added/deleted registry entry $registry_path$ in $dest$
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_defender_submit_samples_consent_feature.yml

@@ -1,59 +0,0 @@
-name: Disable Defender Submit Samples Consent Feature
-id: 73922ff8-3022-11ec-bf5e-acde48001122
-version: 2
-date: '2022-01-26'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic is intended to detect a suspicious modification of the
-  Windows registry to disable a Windows Defender feature. This technique is intended
-  to bypass or evade detection from Windows Defender AV, specifically the feature
-  that submits samples for further analysis.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Registry.registry_value_name: SubmitSamplesConsent
-    TargetObject: '*\\Microsoft\\Windows Defender\\SpyNet*'
-    Details: '0x00000000'
-  condition: selection1
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin or user may choose to disable windows defender product
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
-tags:
-  analytic_story:
-  - IcedID
-  - Windows Registry Abuse
-  - Azorult
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_etw_through_registry.yml

@@ -1,54 +0,0 @@
-name: Disable ETW Through Registry
-id: f0eacfa4-d33f-11eb-8f9d-acde48001122
-version: 2
-date: '2022-01-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: this search is to identify modification in registry to disable ETW windows
-  feature to evade detections. This technique was seen in several ransomware, RAT
-  and even APT to impaire defenses of the compromise machine and to be able to execute
-  payload with minimal alert as much as possible.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000000'
-    TargetObject: '*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: network operator may disable this feature of windows but not
-  so common.
-references:
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
-tags:
-  analytic_story:
-  - Ransomware
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: Disable ETW Through Registry
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25.0
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_logs_using_wevtutil.yml

@@ -1,54 +0,0 @@
-name: Disable Logs Using WevtUtil
-id: 236e7c8e-c9d9-11eb-a824-acde48001122
-version: 1
-date: '2021-06-10'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search is to detect execution of wevtutil.exe to disable logs. This
-  technique was seen in several ransomware to disable the event logs to evade alerts
-  and detections.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*sl*'
-    Image|endswith: wevtutil.exe
-  selection2:
-    CommandLine: '*/e:false*'
-  condition: selection1 and selection2
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: network operator may disable audit event logs for debugging
-  purposes.
-references:
-- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
-tags:
-  analytic_story:
-  - Ransomware
-  asset_type: Endpoint
-  confidence: 80
-  impact: 30
-  message: WevtUtil.exe used to disable Event Logging on $dest
-  mitre_attack_id:
-  - T1070
-  - T1070.001
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 24
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_registry_tool.yml

@@ -1,62 +0,0 @@
-name: Disable Registry Tool
-id: cd2cf33c-9201-11eb-a10a-acde48001122
-version: 2
-date: '2022-01-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search identifies modification of registry to disable the regedit
-  or registry tools of the windows operating system. Since registry tool is a swiss
-  knife in analyzing registry, malware such as RAT or trojan Spy disable this application
-  to prevent the removal of their registry entry such as persistence, file less components
-  and defense evasion.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000001'
-    TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 100
-  impact: 40
-  message: Disabled Registry Tools on $dest$
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 40
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_schedule_task.yml

@@ -1,58 +0,0 @@
-name: Disable Schedule Task
-id: db596056-3019-11ec-a9ff-acde48001122
-version: 1
-date: '2021-10-18'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic is to detect a suspicious commandline to disable existing
-  schedule task. This technique is used by adversaries or commodity malware like IcedID
-  to disable security application (AV products) in the targetted host to evade detections.
-  This TTP is a good pivot to check further why and what other process run before
-  and after this detection. check which process execute the commandline and what task
-  is disabled. parent child process is quite valuable in this scenario too.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*/change*'
-    Image|endswith: schtasks.exe
-  selection2:
-    CommandLine: '*/disable*'
-  condition: selection1 and selection2
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin may disable problematic schedule task
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
-tags:
-  analytic_story:
-  - IcedID
-  - Living Off The Land
-  asset_type: Endpoint
-  confidence: 80
-  impact: 70
-  message: schtask process with commandline $process$ to disable schedule task in
-    $dest$
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 56
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_schtask/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_security_logs_using_minint_registry.yml

@@ -1,57 +0,0 @@
-name: Disable Security Logs Using MiniNt Registry
-id: 39ebdc68-25b9-11ec-aec7-acde48001122
-version: 2
-date: '2022-01-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic is to detect a suspicious registry modification to disable
-  security audit logs. This technique was shared by a researcher to disable Security
-  logs of windows by adding this registry. The Windows will think it is WinPE and
-  will not log any event to the Security Log
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    TargetObject: '*\\Control\\MiniNt\\*'
-  condition: selection1
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: Unknown.
-references:
-- https://twitter.com/0gtweet/status/1182516740955226112
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 100
-  impact: 80
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
-  mitre_attack_id:
-  - T1112
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_show_hidden_files.yml

@@ -1,69 +0,0 @@
-name: Disable Show Hidden Files
-id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
-version: 2
-date: '2022-01-27'
-author: Teoderick Contreras, Mauricio Velazco, Splunk
-status: production
-type: TTP
-description: The following analytic is to identify a modification in the Windows registry
-  to prevent users from seeing all the files with hidden attributes. This event or
-  techniques are known on some worm and trojan spy malware that will drop hidden files
-  on the infected machine.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000001'
-    TargetObject:
-    - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt'
-    - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden'
-  selection2:
-    Details: '0x00000000'
-    TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden'
-  condition: selection1 or selection2
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: unknown
-references:
-- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  - Azorult
-  asset_type: Endpoint
-  confidence: 100
-  impact: 40
-  message: Disabled 'Show Hidden Files' on $dest$
-  mitre_attack_id:
-  - T1564.001
-  - T1562.001
-  - T1564
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 40
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_uac_remote_restriction.yml

@@ -1,62 +0,0 @@
-name: Disable UAC Remote Restriction
-id: 9928b732-210e-11ec-b65e-acde48001122
-version: 2
-date: '2022-01-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic is to detect a suspicious modification of registry to disable
-  UAC remote restriction. This technique was well documented in Microsoft page where
-  attacker may modify this registry value to bypassed UAC feature of windows host.
-  This is a good indicator that some tries to bypassed UAC to suspicious process or
-  gain privilege escalation.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Registry.registry_value_name: LocalAccountTokenFilterPolicy
-    TargetObject: '*\\CurrentVersion\\Policies\\System*'
-    Details: '0x00000001'
-  condition: selection1
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: admin may set this policy for non-critical machine.
-references:
-- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Suspicious Windows Registry Activities
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 100
-  impact: 80
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
-  mitre_attack_id:
-  - T1548.002
-  - T1548
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_windows_app_hotkeys.yml

@@ -1,57 +0,0 @@
-name: Disable Windows App Hotkeys
-id: 1490f224-ad8b-11eb-8c4f-acde48001122
-version: 2
-date: '2022-01-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This analytic detects a suspicious registry modification to disable Windows
-  hotkey (shortcut keys) for native Windows applications. This technique is commonly
-  used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`.
-  This technique is used to impair the analyst in analyzing and removing the attacker
-  implant in compromised systems.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: HotKey Disabled
-    TargetObject: '*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*'
-    Registry.registry_value_name: Debugger
-  condition: selection1
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: unknown
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-tags:
-  analytic_story:
-  - XMRig
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 100
-  impact: 40
-  message: Disabled 'Windows App Hotkeys' on $dest$
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 40
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_windows_behavior_monitoring.yml

@@ -1,70 +0,0 @@
-name: Disable Windows Behavior Monitoring
-id: 79439cae-9200-11eb-a4d3-acde48001122
-version: 2
-date: '2022-01-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search is to identifies a modification in registry to disable the
-  windows denfender real time behavior monitoring. This event or technique is commonly
-  seen in RAT, bot, or Trojan to disable AV to evade detections.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000001'
-    TargetObject:
-    - '*\\Real-Time Protection\\DisableScriptScanning'
-    - '*\\Real-Time Protection\\DisableIOAVProtection'
-    - '*\\Real-Time Protection\\DisableIntrusionPreventionSystem'
-    - '*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring'
-    - '*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable'
-    - '*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection'
-    - '*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin or user may choose to disable this windows features.
-references:
-- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Ransomware
-  - Revil Ransomware
-  - Windows Registry Abuse
-  - Azorult
-  asset_type: Endpoint
-  confidence: 100
-  impact: 40
-  message: Windows Defender real time behavior monitoring disabled on $dest
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 40
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disable_windows_smartscreen_protection.yml

@@ -1,66 +0,0 @@
-name: Disable Windows SmartScreen Protection
-id: 664f0fd0-91ff-11eb-a56f-acde48001122
-version: 2
-date: '2022-01-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: The following search identifies a modification of registry to disable
-  the smartscreen protection of windows machine. This is windows feature provide an
-  early warning system against website that might engage in phishing attack or malware
-  distribution. This modification are seen in RAT malware to cover their tracks upon
-  downloading other of its component or other payload.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: 'Off'
-    TargetObject: '*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin or user may choose to disable this windows features.
-references:
-- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: The Windows Smartscreen was disabled on $dest$ by $user$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disabling_cmd_application.yml

@@ -1,65 +0,0 @@
-name: Disabling CMD Application
-id: ff86077c-9212-11eb-a1e6-acde48001122
-version: 2
-date: '2022-01-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: this search is to identify modification in registry to disable cmd prompt
-  application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging
-  or deleting there samples through cmd application which is one of the tool of analyst
-  to traverse on directory and files.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000001'
-    TargetObject: '*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: The Windows command prompt was disabled on $dest$ by $user$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disabling_controlpanel.yml

@@ -1,64 +0,0 @@
-name: Disabling ControlPanel
-id: 6ae0148e-9215-11eb-a94a-acde48001122
-version: 2
-date: '2022-01-27'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: this search is to identify registry modification to disable control panel
-  window. This technique is commonly seen in malware to prevent their artifacts ,
-  persistence removed on the infected machine.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000001'
-    TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: The Windows Control Panel was disabled on $dest$ by $user$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disabling_defender_services.yml

@@ -1,68 +0,0 @@
-name: Disabling Defender Services
-id: 911eacdc-317f-11ec-ad30-acde48001122
-version: 2
-date: '2022-01-28'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This particular behavior is typically executed when an adversaries or
-  malware gains access to an endpoint and beings to perform execution and to evade
-  detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
-  task modifications will occur. During triage, review parallel processes and identify
-  any further file modifications. Endpoint should be isolated.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    TargetObject:
-    - '*WdBoot*'
-    - '*WdFilter*'
-    - '*WdNisDrv*'
-    - '*WdNisSvc*'
-    - '*WinDefend*'
-    - '*SecurityHealthService*'
-  selection2:
-    TargetObject: '*\\System\\CurrentControlSet\\Services\\*'
-  selection3:
-    Details: '0x00000004'
-    Registry.registry_value_name: Start
-  condition: selection1 and selection2 and selection3
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin or user may choose to disable windows defender product
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
-tags:
-  analytic_story:
-  - IcedID
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: modified/added/deleted registry entry $registry_path$ in $dest$
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disabling_firewall_with_netsh.yml

@@ -1,72 +0,0 @@
-name: Disabling Firewall with Netsh
-id: 6860a62c-9203-11eb-9e05-acde48001122
-version: 2
-date: '2021-03-31'
-author: Teoderick Contreras, Splunk
-status: production
-type: Anomaly
-description: This search is to identifies suspicious firewall disabling using netsh
-  application. this technique is commonly seen in malware that tries to communicate
-  or download its component or other payload to its C2 server.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: netsh.exe
-  selection2:
-    Image|endswith: netsh.exe
-  selection3:
-    CommandLine: '*firewall*'
-  selection4:
-    CommandLine:
-    - '*off*'
-    - '*disable*'
-  condition: (selection1 or selection2) and selection3 and selection4
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: admin may disable firewall during testing or fixing network
-  problem.
-references:
-- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: The Windows Firewall was disabled on $dest$ by $user$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disabling_folderoptions_windows_feature.yml

@@ -1,66 +0,0 @@
-name: Disabling FolderOptions Windows Feature
-id: 83776de4-921a-11eb-868a-acde48001122
-version: 2
-date: '2022-01-28'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search is to identify registry modification to disable folder options
-  feature of windows to show hidden files, file extension and etc. This technique
-  used by malware in combination if disabling show hidden files feature to hide their
-  files and also to hide the file extension to lure the user base on file icons or
-  fake file extensions.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000001'
-    TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disabling_norun_windows_app.yml

@@ -1,68 +0,0 @@
-name: Disabling NoRun Windows App
-id: de81bc46-9213-11eb-adc9-acde48001122
-version: 2
-date: '2022-01-28'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search is to identify modification of registry to disable run application
-  in window start menu. this application is known to be a helpful shortcut to windows
-  OS user to run known application and also to execute some reg or batch script. This
-  technique is used malware to make cleaning of its infection more harder by preventing
-  known application run easily through run shortcut.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000001'
-    TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
-- https://blog.malwarebytes.com/detections/pum-optional-norun/
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: The Windows registry was modified to disable run application in window
-    start menu on $dest$ by $user$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disabling_remote_user_account_control.yml

@@ -1,62 +0,0 @@
-name: Disabling Remote User Account Control
-id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c
-version: 4
-date: '2020-11-18'
-author: David Dorsey, Patrick Bareiss, Splunk
-status: production
-type: TTP
-description: The search looks for modifications to registry keys that control the
-  enforcement of Windows User Account Control (UAC).
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000000'
-    TargetObject: '*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA*'
-  condition: selection1
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black, or via other endpoint data sources, such as Sysmon.
-  The data used for this search is typically generated via logs that report registry
-  modifications.
-known_false_positives: This registry key may be modified via administrators to implement
-  a change in system policy. This type of change should be a very rare occurrence.
-references: []
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Suspicious Windows Registry Activities
-  - Remcos
-  - Windows Registry Abuse
-  - Azorult
-  - AgentTesla
-  asset_type: Endpoint
-  confidence: 60
-  impact: 70
-  message: The Windows registry keys that control the enforcement of Windows User
-    Account Control (UAC) were modified on $dest$ by $user$.
-  mitre_attack_id:
-  - T1548.002
-  - T1548
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 42
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disabling_systemrestore_in_registry.yml

@@ -1,69 +0,0 @@
-name: Disabling SystemRestore In Registry
-id: f4f837e2-91fb-11eb-8bf6-acde48001122
-version: 2
-date: '2022-01-28'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: The following search identifies the modification of registry related
-  in disabling the system restore of a machine. This event or behavior are seen in
-  some RAT malware to make the restore of the infected machine  difficult and keep
-  their infection on the box.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000001'
-    TargetObject:
-    - '*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig'
-    - '*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR'
-    - '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig'
-    - '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: in some cases admin can disable systemrestore on a machine.
-references:
-- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: The Windows registry was modified to disable system restore on $dest$ by
-    $user$.
-  mitre_attack_id:
-  - T1490
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/disabling_task_manager.yml

@@ -1,66 +0,0 @@
-name: Disabling Task Manager
-id: dac279bc-9202-11eb-b7fb-acde48001122
-version: 2
-date: '2022-01-28'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-description: This search is to identifies modification of registry to disable the
-  task manager of windows operating system. this event or technique are commonly seen
-  in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate
-  their process.
-data_source:
-- Sysmon Event ID 13
-search:
-  selection1:
-    Details: '0x00000001'
-    TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr'
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
-- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 60
-  impact: 70
-  message: The Windows Task Manager was disabled on $dest$ by $user$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 42
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
-    update_timestamp: true
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/dllhost_with_no_command_line_arguments_with_network.yml

@@ -1,66 +0,0 @@
-name: DLLHost with no Command Line Arguments with Network
-id: f1c07594-a141-11eb-8407-acde48001122
-version: 3
-date: '2022-03-15'
-author: Michael Haag, Splunk
-status: production
-type: TTP
-description: The following analytic identifies DLLHost.exe with no command line arguments
-  with a network connection. It is unusual for DLLHost.exe to execute with no command
-  line arguments present. This particular behavior is common with malicious software,
-  including Cobalt Strike. During investigation, triage any network connections and
-  parallel processes. Identify any suspicious module loads related to credential dumping
-  or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    Image|endswith: dllhost.exe
-  condition: selection1
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
-known_false_positives: Although unlikely, some legitimate third party applications
-  may use a moved copy of dllhost, triggering a false positive.
-references:
-- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
-- https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/
-tags:
-  analytic_story:
-  - Cobalt Strike
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: The process $process_name$ was spawned by $parent_image$ without any command-line
-    arguments on $dest$ by $user$.
-  mitre_attack_id:
-  - T1055
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_image
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/domain_account_discovery_with_dsquery.yml

@@ -1,61 +0,0 @@
-name: Domain Account Discovery with Dsquery
-id: b1a8ce04-04c2-11ec-bea7-acde48001122
-version: 1
-date: '2021-08-24'
-author: Teoderick Contreras, Mauricio Velazco, Splunk
-status: production
-type: Hunting
-description: This analytic looks for the execution of `dsquery.exe` with command-line
-  arguments utilized to discover  domain users. The `user` argument returns a list
-  of all users registered in the domain. Red Teams and adversaries alike engage in
-  remote system discovery for situational awareness and Active Directory Discovery.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    CommandLine: '*user*'
-    Image|endswith: dsquery.exe
-  condition: selection1
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
-- https://attack.mitre.org/techniques/T1087/002/
-tags:
-  analytic_story:
-  - Active Directory Discovery
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: an instance of process $process_name$ with commandline $process$ in $dest$
-  mitre_attack_id:
-  - T1087.002
-  - T1087
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

dev/endpoint/domain_account_discovery_with_net_app.yml

@@ -1,71 +0,0 @@
-name: Domain Account Discovery With Net App
-id: 98f6a534-04c2-11ec-96b2-acde48001122
-version: 1
-date: '2021-08-24'
-author: Teoderick Contreras, Mauricio Velazco, Splunk
-status: production
-type: TTP
-description: This analytic looks for the execution of `net.exe` or `net1.exe` with
-  command-line arguments utilized to query for domain users. Red Teams and adversaries
-  alike may use net.exe to enumerate domain users for situational awareness and Active
-  Directory Discovery.
-data_source:
-- Sysmon Event ID 1
-search:
-  selection1:
-    OriginalFileName: net.exe
-  selection2:
-    Image|endswith: net.exe
-  selection3:
-    Image|endswith: net1.exe
-  selection4:
-    OriginalFileName: net1.exe
-  selection5:
-    CommandLine: '* user*'
-  selection6:
-    CommandLine: '*/do*'
-  condition: (selection1 or selection2 or selection3 or selection4) and selection5
-    and selection6
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance
-- https://attack.mitre.org/techniques/T1087/002/
-tags:
-  analytic_story:
-  - Active Directory Discovery
-  asset_type: Endpoint
-  confidence: 50
-  impact: 50
-  message: an instance of process $process_name$ with commandline $process$ in $dest$
-  mitre_attack_id:
-  - T1087.002
-  - T1087
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog