RISKY FRISKY

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -8,8 +8,8 @@ datamodel:
 - Endpoint
 description: This analytic detects a potential suspicious modification of firewall
   rule registry allowing inbound traffic in specific port with public profile. This
-  technique was seen in some attacker want to have a remote access to a machine by
-  allowing the traffic in firewall rule.
+  technique was identified when an adversary wants to grant remote access to a machine by
+  allowing the traffic in a firewall rule.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
   Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name =
@@ -47,3 +47,20 @@ tags:
   - Registry.dest
   - Registry.user
   security_domain: endpoint
+  impact: 10
+  confidence: 30
+  # (impact * confidence)/100
+  risk_score: 3
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml

@@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect suspicious powershell command to allow inbound
-  traffic in specific local port with public profile. This technique was seen in some
+description: The following analytic identifies suspicious PowerShell command to allow inbound
+  traffic inbound to a specific local port within the public profile. This technique was seen in some
   attacker want to have a remote access to a machine by allowing the traffic in firewall
   rule.
 search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message
@@ -42,3 +42,20 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+  impact: 10
+  confidence: 30
+  # (impact * confidence)/100
+  risk_score: 3
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/allow_network_discovery_in_firewall.yml

@@ -42,7 +42,6 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
   - Processes.process_name
   - Processes.process
   - Processes.process_id

detections/endpoint/allow_operation_with_consent_admin.yml

@@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to detect a potential privilege escalation attempt to
-  do malicious task. This registry modification is designed to allows the `Consent
+description: This analytic identifies a potential privilege escalation attempt to
+  perform malicious task. This registry modification is designed to allow the `Consent
   Admin` to perform an operation that requires elevation without consent or credentials.
   We also found this in some attacker to gain privilege escalation to the compromise
   machine.
@@ -48,3 +48,20 @@ tags:
   - Registry.registry_value_name
   - Registry.dest
   security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/anomalous_usage_of_7zip.yml

@@ -49,8 +49,33 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/any_powershell_downloadfile.yml

@@ -48,8 +48,33 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/any_powershell_downloadstring.yml

@@ -50,8 +50,26 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml

@@ -9,8 +9,8 @@ datamodel:
 description: Attempt To Add Certificate To Untrusted Store
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
   as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil*
-  (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name
-  Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.process_name
+    Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -48,8 +48,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.process_name
-  - Processes.parent_process
+  - Processes.dest
   - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 70
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 35
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/attempt_to_stop_security_service.yml

@@ -11,7 +11,8 @@ description: This search looks for attempts to stop security-related services on
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where (Processes.process_name = net.exe OR  Processes.process_name = sc.exe) Processes.process="*
-  stop *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user
+  stop *" Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   |lookup security_services_lookup service as process OUTPUTNEW category, description
   | search category=security | `attempt_to_stop_security_service_filter`'
@@ -56,8 +57,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 40
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -13,9 +13,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
   OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*
   OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*)
-  by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `attempted_credential_dump_from_registry_via_reg_exe_filter`'
+  | `attempted_credential_dump_from_registry_via_reg_exe_filter`'`
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
@@ -47,9 +48,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
-  - Processes.dest
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
-
-  
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/batch_file_write_to_system32.yml

@@ -53,3 +53,24 @@ tags:
   - Filesystem.user
   - Filesystem.file_path
   security_domain: endpoint
+  impact: 70
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Victim

detections/endpoint/bcdedit_failure_recovery_modification.yml

@@ -49,3 +49,28 @@ tags:
   - Processes.dest
   - Processes.user
   security_domain: endpoint
+  impact: 100
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/bits_job_persistence.yml

@@ -48,8 +48,33 @@ tags:
   required_fields:
   - _time
   - Processes.process
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.user
   - Processes.dest
   security_domain: endpoint
+  impact: 70
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/bitsadmin_download_file.yml

@@ -54,8 +54,33 @@ tags:
   required_fields:
   - _time
   - Processes.process
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.user
   - Processes.dest
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml

@@ -46,8 +46,33 @@ tags:
   required_fields:
   - _time
   - Processes.process
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.user
   - Processes.dest
   security_domain: endpoint
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml

@@ -47,8 +47,33 @@ tags:
   required_fields:
   - _time
   - Processes.process
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.user
   - Processes.dest
   security_domain: endpoint
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/certutil_exe_certificate_extraction.yml

@@ -11,8 +11,8 @@ description: This search looks for arguments to certutil.exe indicating the mani
   tokens specially inside Federated environments such as Windows ADFS.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
   as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
-  Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name
-  Processes.process Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -37,8 +37,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.process_name
-  - Processes.parent_process
+  - Processes.dest
   - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 90
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/certutil_with_decode_argument.yml

@@ -47,10 +47,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.user
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
-
+  impact: 50
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 40
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/clear_unallocated_sector_using_cipher_app.yml

@@ -39,7 +39,6 @@ tags:
   required_fields:
   - _time
   - Processes.parent_process_name
-  - Processes.parent_process
   - Processes.process_name
   - Processes.process
   - Processes.dest
@@ -47,3 +46,28 @@ tags:
   - Processes.process_id
   - Processes.process_guid
   security_domain: endpoint
+  impact: 100
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/clop_common_exec_parameter.yml

@@ -17,8 +17,8 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   values(Processes.parent_process_name) as parent_process values(Processes.process_name)
   count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process
-  = "*temp.dat*" by Processes.parent_process_name Processes.process_name Processes.process
-  Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)`
+  = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+    Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -42,11 +42,37 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.process
-  - Processes.parent_process_name
   - _time
-  - Processes.process_name
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 100
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 100
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/clop_ransomware_known_service_name.yml

@@ -44,3 +44,28 @@ tags:
   - OriginalFileName
   - process_path
   security_domain: endpoint
+  impact: 100
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 100
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/cmd_echo_pipe___escalation.yml

@@ -44,9 +44,34 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml

@@ -46,3 +46,24 @@ tags:
   - Signed
   - ProcessId
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: ImageLoaded
+    type: Other
+    role:
+    - Other

detections/endpoint/cobalt_strike_named_pipes.yml

@@ -68,3 +68,24 @@ tags:
   - process_path
   - process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Parent Process

detections/endpoint/common_ransomware_extensions.yml

@@ -65,3 +65,25 @@ tags:
   - Filesystem.file_path
   - Filesystem.file_name
   security_domain: endpoint
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  Consequence: Data Destruction
+  message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Victim

detections/endpoint/common_ransomware_notes.yml

@@ -51,3 +51,25 @@ tags:
   - Filesystem.file_path
   - Filesystem.file_name
   security_domain: endpoint
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  Consequence: Data Destruction
+  message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Victim

detections/endpoint/conti_common_exec_parameter.yml

@@ -40,11 +40,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.dest Processes.user
   - Processes.process_id
-  - Processes.process_guid
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -46,9 +46,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
-  - Processes.dest
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 50
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 30
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml

@@ -45,9 +45,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.user
-  - Processes.parent_process
-  - Processs.process_name
-  - Processes.process
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/create_remote_thread_into_lsass.yml

@@ -48,4 +48,22 @@ tags:
   - EventCode
   - TargetImage
   - TargetProcessId
+  - dest
   security_domain: endpoint
+  impact: 90
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated.
+  observable:
+  - name: TargetImage
+    type: Other
+    role:
+    - Other
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/create_service_in_suspicious_file_path.yml

@@ -29,7 +29,6 @@ tags:
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
-  - T1569.001
   - T1569.002
   product:
   - Splunk Enterprise
@@ -43,3 +42,20 @@ tags:
   - Service_Name
   - Service_Start_Type
   security_domain: endpoint
+  impact: 70
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: A service $Service_File_Name$ was created from a non-standard path using $Service_Name$, potentially leading to a privilege escalation.
+  observable:
+  - name: Service_File_Name
+    type: Other
+    role:
+    - Other
+  - name: Service_Name
+    type: Other
+    role:
+    - Other

detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml

@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
 type: batch
 datamodel: []
 description: Detect the hands on keyboard behavior of Windows Task Manager creating
-  a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification
+  a process dump of lsass.exe. Upon this behavior occurring, a file write/modification
   will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp,
   cannot be renamed, however if the dump occurs more than once, it will be named lsass
   (2).dmp.
@@ -54,3 +54,28 @@ tags:
   - Computer
   - object_category
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: TargetFilename
+    type: File Name
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/creation_of_shadow_copy.yml

@@ -45,11 +45,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+    impact: 90
+    confidence: 90
+    # (impact * confidence)/100
+    risk_score: 81
+    context:
+    - Source:Endpoint
+    - Stage:Credential Access
+    message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
+    observable:
+    - name: user
+      type: User
+      role:
+      - Victim
+    - name: dest
+      type: Hostname
+      role:
+      - Victim
+    - name: parent_process
+      type: Parent Process
+      role:
+      - Parent Process
+    - name: process_name
+      type: Process
+      role:
+      - Child Process

detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml

@@ -41,8 +41,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
-  - Processes.user
-  - Processes.dest
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 90
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml

@@ -48,7 +48,32 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 90
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml

@@ -46,7 +46,32 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 90
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/delete_shadowcopy_with_powershell.yml

@@ -45,3 +45,20 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+  impact: 90
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$.
+  observable:
+  - name: User
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/deleting_of_net_users.yml

@@ -43,10 +43,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
   - Processes.dest
   - Processes.user
   - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
-  - Processes.parent_process
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/deleting_shadow_copies.yml

@@ -51,10 +51,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.parent_process
-  - Processes.process_name
+  - Processes.dest
   - Processes.user
   - Processes.parent_process_name
-  - Processes.dest
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 90
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml

@@ -50,3 +50,24 @@ tags:
   - user
   - dest
   security_domain: access
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: EventCode
+    type: Other
+    role:
+    - Other

detections/endpoint/detect_azurehound_command_line_arguments.yml

@@ -47,9 +47,34 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_azurehound_file_modifications.yml

@@ -54,3 +54,24 @@ tags:
   - process_id
   - file_create_time
   security_domain: endpoint
+  impact: 70
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  message: A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Victim

detections/endpoint/detect_computer_changed_with_anonymous_account.yml

@@ -45,3 +45,24 @@ tags:
   - TargetDomainName
   - user
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: EventCode
+    type: Other
+    role:
+    - Other

detections/endpoint/detect_credential_dumping_through_lsass_access.yml

@@ -58,3 +58,24 @@ tags:
   - TargetImage
   - TargetProcessId
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated.
+  observable:
+  - name: source_image
+    type: Other
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: TargetImage
+    type: Other
+    role:
+    - Victim

detections/endpoint/detect_empire_with_powershell_script_block_logging.yml

@@ -57,3 +57,20 @@ tags:
   - User
   - EventCode
   security_domain: endpoint
+  impact: 90
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$.
+  observable:
+  - name: User
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml

@@ -56,3 +56,20 @@ tags:
   - All_Changes.result
   - All_Changes.dest
   security_domain: access
+  impact: 60
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: Multiple accounts have been locked out. Review $dest$ and results related to $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/detect_excessive_user_account_lockouts.yml

@@ -44,3 +44,20 @@ tags:
   - nodename
   - All_Changes.user
   security_domain: access
+  impact: 60
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: result
+    type: Other
+    role:
+    - Victim

detections/endpoint/detect_exchange_web_shell.yml

@@ -53,3 +53,24 @@ tags:
   - Filesystem.file_hash
   - Filesystem.user
   security_domain: endpoint
+  impact: 90
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Exploitation
+  message: A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Victim

detections/endpoint/detect_html_help_renamed.yml

@@ -61,3 +61,28 @@ tags:
   - process_path
   - CommandLine
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_html_help_spawn_child_process.yml

@@ -58,9 +58,33 @@ tags:
   - Processes.parent_process_name
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
   - Processes.process_name
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_html_help_url_in_command_line.yml

@@ -61,8 +61,32 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
-
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml

@@ -63,6 +63,27 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_mimikatz_using_loaded_images.yml

@@ -56,3 +56,28 @@ tags:
   - Computer
   - Image
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: ImageLoaded
+    type: Parent Process
+    role:
+    - Other
+  - name: Image
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml

@@ -54,3 +54,20 @@ tags:
   - User
   - EventCode
   security_domain: endpoint
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$.
+  observable:
+  - name: User
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/detect_mshta_inline_hta_execution.yml

@@ -49,10 +49,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.parent_process
-  - Processes.user
-  - Processes.process_name
-  - Processes.parent_process_name
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_mshta_renamed.yml

@@ -55,3 +55,28 @@ tags:
   - process_path
   - CommandLine
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_mshta_url_in_command_line.yml

@@ -50,9 +50,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.user
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_new_local_admin_account.yml

@@ -48,4 +48,22 @@ tags:
   - Group_Name
   - member_id
   - dest
+  - user
   security_domain: access
+  impact: 60
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  message: A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml

@@ -46,9 +46,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.parent_process_name
+  - Processes.dest
   - Processes.user
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
-  - Processes.dest
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml

@@ -9,7 +9,7 @@ datamodel:
 description: This search looks for fast execution of processes used for system network
   configuration discovery on the endpoint.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
-  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
+  as process values(Processes.parent_process_name) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name
   Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools`
@@ -49,9 +49,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.parent_process
   - Processes.dest
-  - Processes.process_name
   - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 40
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 32
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  message: An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml

@@ -47,9 +47,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.process_name
-  - Processes.parent_process_name
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -16,8 +16,8 @@ description: This search looks for events where `PsExec.exe` is run with the `ac
   within the command line.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process=*psexec* Processes.process=*accepteula* by Processes.process_name
-  Processes.dest  Processes.parent_process_name | `drop_dm_object_name(Processes)`|
+  where Processes.process=*psexec* Processes.process=*accepteula* Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`|
   `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -55,8 +55,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.process_name
   - Processes.dest
+  - Processes.user
   - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 50
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 35
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_rclone_command_line_usage.yml

@@ -54,3 +54,28 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 50
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 35
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_regasm_spawning_a_process.yml

@@ -60,3 +60,28 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_regasm_with_network_connection.yml

@@ -61,3 +61,24 @@ tags:
   - dest_host
   - dest_ip
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_regasm_with_no_command_line_arguments.yml

@@ -60,3 +60,28 @@ tags:
   - process_path
   - Computer
   security_domain: endpoint
+    impact: 70
+    confidence: 70
+    # (impact * confidence)/100
+    risk_score: 49
+    context:
+    - Source:Endpoint
+    - Stage:Defense Evasion
+    message: The process $process_name$ was spawned by $parent_image$ without any command-line arguements on $dest$ by $user$.
+    observable:
+    - name: user
+      type: User
+      role:
+      - Victim
+    - name: dest
+      type: Hostname
+      role:
+      - Victim
+    - name: parent_image
+      type: Parent Process
+      role:
+      - Parent Process
+    - name: process_name
+      type: Process
+      role:
+      - Child Process

detections/endpoint/detect_regsvcs_spawning_a_process.yml

@@ -60,3 +60,28 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$  was identified on endpoint $dest$ by user $user$ typically not normal for this process.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_regsvcs_with_network_connection.yml

@@ -60,3 +60,24 @@ tags:
   - src_ip
   - dest_host
   security_domain: Endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml

@@ -61,3 +61,28 @@ tags:
   - process_path
   - Computer
   security_domain: endpoint
+    impact: 70
+    confidence: 70
+    # (impact * confidence)/100
+    risk_score: 49
+    context:
+    - Source:Endpoint
+    - Stage:Defense Evasion
+    message: The process $process_name$ was spawned by $parent_image$ without any command-line arguements on $dest$ by $user$.
+    observable:
+    - name: user
+      type: User
+      role:
+      - Victim
+    - name: dest
+      type: Hostname
+      role:
+      - Victim
+    - name: parent_image
+      type: Parent Process
+      role:
+      - Parent Process
+    - name: process_name
+      type: Process
+      role:
+      - Child Process

detections/endpoint/detect_regsvr32_application_control_bypass.yml

@@ -60,7 +60,32 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name
   - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_renamed_7_zip.yml

@@ -47,3 +47,28 @@ tags:
   - CommandLine
   - Product
   security_domain: endpoint
+  impact: 30
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 27
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_renamed_psexec.yml

@@ -57,3 +57,28 @@ tags:
   - CommandLine
   - Product
   security_domain: endpoint
+  impact: 30
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 27
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_renamed_rclone.yml

@@ -50,3 +50,28 @@ tags:
   - CommandLine
   - dest
   security_domain: endpoint
+  impact: 30
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 27
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_renamed_winrar.yml

@@ -51,3 +51,28 @@ tags:
   - CommandLine
   - Product
   security_domain: endpoint
+  impact: 30
+  confidence: 90
+  # (impact * confidence)/100
+  risk_score: 27
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

@@ -17,8 +17,8 @@ description: The following analytic identifies rundll32.exe loading advpack.dll
   It's possible other files are on disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*advpack* by Processes.user Processes.process_name Processes.process
-  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -53,8 +53,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
   - Processes.process_name
   - Processes.process
-  - Processes.user
-  - Processes.dest
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml

@@ -17,8 +17,8 @@ description: The following analytic identifies rundll32.exe loading setupapi.dll
   It's possible other files are on disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process
-  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -53,8 +53,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.process_name
-  - Processes.user
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml

@@ -17,8 +17,8 @@ description: The following analytic identifies rundll32.exe loading syssetup.dll
   files are on disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process
-  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -53,8 +53,36 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.process_name
-  - Processes.user
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/detect_rundll32_inline_hta_execution.yml

@@ -63,9 +63,11 @@ tags:
   confidence: 80
   risk_score: 56
   context:
-  - Source: Endpoint
-  - Stage: Initial Access, Execution, Defense Evasion
-  message: Suspicious rundll32.exe inline HTA execution on $dest
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Execution
+  - Stage:Defense Evasion
+  message: Suspicious rundll32.exe inline HTA execution on $dest$
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/detect_sharphound_command_line_arguments.yml

@@ -61,9 +61,9 @@ tags:
   confidence: 80
   risk_score: 24
   context:
-  - Source: Endpoint
-  - Stage: Discovery
-  message: Possible SharpHound command-Line arguments identified on $dest
+  - Source:Endpoint
+  - Stage:Discovery
+  message: Possible SharpHound command-Line arguments identified on $dest$
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/detect_sharphound_file_modifications.yml

@@ -69,9 +69,9 @@ tags:
   confidence: 80
   risk_score: 24
   context:
-  - Source: Endpoint
-  - Stage: Discovery
-  message: Potential SharpHound file modifications identified on $dest
+  - Source:Endpoint
+  - Stage:Discovery
+  message: Potential SharpHound file modifications identified on $dest$
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/detect_sharphound_usage.yml

@@ -65,9 +65,9 @@ tags:
   confidence: 80
   risk_score: 24
   context:
-  - Source: Endpoint
-  - Stage: Discovery
-  message: Potential SharpHound binary identified on $dest
+  - Source:Endpoint
+  - Stage:Discovery
+  message: Potential SharpHound binary identified on $dest$
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml

@@ -56,9 +56,11 @@ tags:
   confidence: 50
   risk_score: 35
   context:
-  - Source: Endpoint
-  - Stage: Initial Access, Execution, Defense Evasion
-  message: cmd.exe launching script interpreters on $dest
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Execution
+  - Stage:Defense Evasion
+  message: cmd.exe launching script interpreters on $dest$
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/detect_wmi_event_subscription_persistence.yml

@@ -59,9 +59,10 @@ tags:
   confidence: 90
   risk_score: 63
   context:
-  - Source: Endpoint
-  - Stage: Persistence, Privilege Escalation
-  message: Possible malicious WMI Subscription created on $dest
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  message: Possible malicious WMI Subscription created on $dest$
   observable:
   - name: dest
     type: Endpoint