From 74f3cee9e207f65092006a8ffb27642caafedcbf Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 22 Feb 2022 16:54:08 -0800
Subject: [PATCH] Fixed SearchProtocolHost with no Command Line with Network

---
 ...host_with_no_command_line_with_network.yml | 29 ++++++++++++-------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
index 54f3073620..fffabb6e2f 100644
--- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
@@ -1,11 +1,12 @@
 name: SearchProtocolHost with no Command Line with Network
 id: b690df8c-a145-11eb-a38b-acde48001122
-version: 2
-date: '2021-10-13'
+version: 3
+date: '2022-02-22'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
+- Network_Traffic
 description: The following analytic identifies searchprotocolhost.exe with no command
   line arguments and with a network connection. It is unusual for searchprotocolhost.exe
   to execute with no command line arguments present. This particular behavior is common
@@ -13,15 +14,21 @@ description: The following analytic identifies searchprotocolhost.exe with no co
   any network connections and parallel processes. Identify any suspicious module loads
   related to credential dumping or file writes. searchprotocolhost.exe is natively
   found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_guid
-  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | regex process="(searchprotocolhost\.exe.{0,4}$)" | join  process_guid [| tstats
-  `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port
-  !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
-  | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
-  process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
+search: '| tstats `security_content_summariesonly` count FROM 
+  datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe 
+  by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | regex process="(searchprotocolhost\.exe.{0,4}$)" 
+  | join process_guid 
+    [ | tstats `security_content_summariesonly` count FROM 
+        datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port !="0" 
+        by All_Traffic.process_guid All_Traffic.dest All_Traffic.dest_port 
+      | `drop_dm_object_name(All_Traffic)` 
+      | rename dest as connection_to_CNC ] 
+  | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port 
+  | `searchprotocolhost_with_no_command_line_with_network_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.