Branch was auto-updated.

detections/endpoint/adsisearcher_account_discovery.yml

@@ -0,0 +1,61 @@
+name: AdsiSearcher Account Discovery
+id: de7fcadc-04f3-11ec-a241-acde48001122
+version: 1
+date: '2021-08-24'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a powershell command adsisearcher to do user
+  enumeration to the active directory. This command can be a normal query of a network
+  admin but since the output of this is not so much structure and cannot give a concrete
+  or specific information that admin may look upon this is still a good TTP to alert
+  some malicious activities.
+search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*"
+  Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime
+  by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `adsisearcher_account_discovery_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: not commonly seen as a normal command from network admin but
+  possible noise may exist.
+references:
+- https://www.blackhillsinfosec.com/red-blue-purple/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - source:endpoint
+  - stage:Reconnaissance
+  message: powershell process having commandline $Message$ for user enumeration
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/domain_account_discovery_with_dsquery.yml

@@ -0,0 +1,71 @@
+name: Domain Account Discovery with Dsquery
+id: b1a8ce04-04c2-11ec-bea7-acde48001122
+version: 1
+date: '2021-08-24'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious process commandline of dsquery
+  for enumerating users. This technique is commonly in attacker and red team to recon
+  on users in targetted machine. This command can also be used by network administrator
+  but not by a normal user.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name="dsquery.exe"
+  AND Processes.process = "*user*" by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: network administrator may use this command but not commonly
+  seen used by a user.
+references:
+- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  automated_detection_testing: passed

detections/endpoint/domain_account_discovery_with_net_app.yml

@@ -0,0 +1,71 @@
+name: Domain Account Discovery With Net App
+id: 98f6a534-04c2-11ec-96b2-acde48001122
+version: 1
+date: '2021-08-24'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a process command line for AD discovery. This
+  techique is using the windows built in net.exe application to query AD users in
+  the targetted machine. This techique was seen in several malware as part of there
+  recon and can be a good pivot of analysis.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
+  OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process
+  = "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `domain_account_discovery_with_net_app_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: network operator can execute this command
+references:
+- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  automated_detection_testing: passed

detections/endpoint/domain_account_discovery_with_wmic.yml

@@ -0,0 +1,72 @@
+name: Domain Account Discovery with Wmic
+id: 383572e0-04c5-11ec-bdcc-acde48001122
+version: 1
+date: '2021-08-24'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a wmic command for enumerating user in active
+  directory. This technique was commonly used in pentesting, red-team and also by
+  some attacker to map all user in the targetted host. This search may also catch
+  this type of query made by network admin but not common in all the user in the network.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe"
+  AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process
+  = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `domain_account_discovery_with_wmic_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: network admin may execute this command for listing users.
+references:
+- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  automated_detection_testing: passed

detections/endpoint/get_aduser_with_powershell.yml

@@ -0,0 +1,72 @@
+name: Get ADUser with PowerShell
+id: 0b6ee3f4-04e3-11ec-a87d-acde48001122
+version: 1
+date: '2021-08-24'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious commandline that commonly uses
+  for enumerating users in active directory. This  technique can be a good indicator
+  to hunt further TTPs to the machine to check further anomalies. Since this is a
+  hunt query expect some noise from administrator or some IT within the network that
+  may use this command.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
+  OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*"
+  AND Processes.process = "*-filter*" by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: network admin may use this command.
+references:
+- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  automated_detection_testing: passed

detections/endpoint/get_aduser_with_powershell_script_block.yml

@@ -0,0 +1,61 @@
+name: Get ADUser with PowerShell Script Block
+id: 21432e40-04f4-11ec-b7e6-acde48001122
+version: 1
+date: '2021-08-24'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This search is to detect a powershell command get-aduser function to
+  do user enumeration to the active directory. This command can be a normal query
+  of a network admin but since the output of this is not so much structure and cannot
+  give a concrete or specific information that admin may look upon this is still a
+  good TTP to alert some malicious activities.
+search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `get_aduser_with_powershell_script_block_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: network admin may use this command and other IT operator to
+  check AD users.
+references:
+- https://www.blackhillsinfosec.com/red-blue-purple/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - source:endpoint
+  - stage:Reconnaissance
+  message: powershell process having commandline $Message$ for user enumeration
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/get_domainuser_with_powershell.yml

@@ -0,0 +1,70 @@
+name: Get DomainUser with PowerShell
+id: 9a5a41d6-04e7-11ec-923c-acde48001122
+version: 1
+date: '2021-08-24'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a cmdlet Get-DomainUser that are common on powerview
+  or powersploit tool. This cmdlet is used to recon on the targetted machine to enumerate
+  all users in active directory.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
+  OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `get_domainuser_with_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  automated_detection_testing: passed

detections/endpoint/get_domainuser_with_powershell_script_block.yml

@@ -0,0 +1,60 @@
+name: Get DomainUser with PowerShell Script Block
+id: 61994268-04f4-11ec-865c-acde48001122
+version: 1
+date: '2021-08-24'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: his search is to detect a powershell command Get-DomainUser to do user
+  enumeration to the active directory. This command is function seen in powerspoit
+  and powerview tool that are designed to pentest active directory or domain controller
+  for possible attack. This is a good TTP for alerting SOC if there is a pentest or
+  recon happening on the system. try to look for lateral movement technique or credential
+  dumping techniques in the system.
+search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: unknown
+references:
+- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - source:endpoint
+  - stage:Reconnaissance
+  message: powershell process having commandline $Message$ for user enumeration
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/getwmiobject_ds_user_with_powershell.yml

@@ -0,0 +1,72 @@
+name: GetWmiObject DS User with PowerShell
+id: 22d3b118-04df-11ec-8fa3-acde48001122
+version: 1
+date: '2021-08-24'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious execution wmi process that enumerate
+  user in active directory. This technique can be used by attacker and pentester to
+  mapped all the users as part of its recon to the targetted host. Network Admin may
+  seen executing this command but not often and also not common to see in user events.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
+  OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*"
+  AND Processes.process = "*ds_user*" AND Processes.process = "*root\\directory\\ldap*"
+  AND Processes.process = "*-namespace*" by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: network admin may execute this command.
+references:
+- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  automated_detection_testing: passed

detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml

@@ -0,0 +1,62 @@
+name: GetWmiObject DS User with PowerShell Script Block
+id: fabd364e-04f3-11ec-b34b-acde48001122
+version: 1
+date: '2021-08-24'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a powershell command get-wmiobject function
+  to do user enumeration to the active directory. This command can be a normal query
+  of a network admin but since the output of this is not so much structure and cannot
+  give a concrete or specific information that admin may look upon this is still a
+  good TTP to alert some malicious activities.
+search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*"
+  Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`'
+how_to_implement: he following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: not commonly seen as a normal command from network admin but
+  possible noise may exist.
+references:
+- https://www.blackhillsinfosec.com/red-blue-purple/
+- https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - source:endpoint
+  - stage:Reconnaissance
+  message: powershell process having commandline $Message$ for user enumeration
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

tests/endpoint/adsisearcher_account_discovery.test.yml

@@ -0,0 +1,12 @@
+name: AdsiSearcher Account Discovery Unit Test
+tests:
+- name: AdsiSearcher Account Discovery
+  file: endpoint/adsisearcher_account_discovery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/domain_account_discovery_with_dsquery.test.yml

@@ -0,0 +1,12 @@
+name: Domain Account Discovery with Dsquery Unit Test
+tests:
+- name: Domain Account Discovery with Dsquery
+  file: endpoint/domain_account_discovery_with_dsquery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/domain_account_discovery_with_net_app.test.yml

@@ -0,0 +1,12 @@
+name: Domain Account Discovery With Net App Unit Test
+tests:
+- name: Domain Account Discovery With Net App
+  file: endpoint/domain_account_discovery_with_net_app.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/domain_account_discovery_with_wmic.test.yml

@@ -0,0 +1,12 @@
+name: Domain Account Discovery with Wmic Unit Test
+tests:
+- name: Domain Account Discovery with Wmic
+  file: endpoint/domain_account_discovery_with_wmic.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/get_aduser_with_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Get ADUser with PowerShell Unit Test
+tests:
+- name: Get ADUser with PowerShell
+  file: endpoint/get_aduser_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/get_aduser_with_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: Get ADUser with PowerShell Script Block Unit Test
+tests:
+- name: Get ADUser with PowerShell Script Block
+  file: endpoint/get_aduser_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/get_domainuser_with_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Get DomainUser with PowerShell Unit Test
+tests:
+- name: Get DomainUser with PowerShell
+  file: endpoint/get_domainuser_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/get_domainuser_with_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: Get DomainUser with PowerShell Script Block Unit Test
+tests:
+- name: Get DomainUser with PowerShell Script Block
+  file: endpoint/get_domainuser_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml

@@ -0,0 +1,12 @@
+name: GetWmiObject DS User with PowerShell Unit Test
+tests:
+- name: GetWmiObject DS User with PowerShell
+  file: endpoint/getwmiobject_ds_user_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: GetWmiObject DS User with PowerShell Script Block Unit Test
+tests:
+- name: GetWmiObject DS User with PowerShell Script Block
+  file: endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog