From 2ffbb6a24475ddc5c77856f9cf8f96c00166b8ad Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 27 Apr 2022 12:19:45 +0200
Subject: [PATCH 01/14] industroyer2_PR3

---
 .../windows_hidden_schedule_task_settings.yml | 70 +++++++++++++++++++
 ...ows_hidden_schedule_task_settings.test.yml | 12 ++++
 2 files changed, 82 insertions(+)
 create mode 100644 detections/endpoint/windows_hidden_schedule_task_settings.yml
 create mode 100644 tests/endpoint/windows_hidden_schedule_task_settings.test.yml

diff --git a/detections/endpoint/windows_hidden_schedule_task_settings.yml b/detections/endpoint/windows_hidden_schedule_task_settings.yml
new file mode 100644
index 0000000000..2e55b57627
--- /dev/null
+++ b/detections/endpoint/windows_hidden_schedule_task_settings.yml
@@ -0,0 +1,70 @@
+name: Windows Hidden Schedule Task Settings
+id: 0b730470-5fe8-4b13-93a7-fe0ad014d0cc
+version: 1
+date: '2022-04-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following query utilizes Windows Security EventCode 4698, 
+  A scheduled task was created, to identify suspicious tasks registered on 
+  Windows either via schtasks.exe OR TaskService with a hidden settings
+  that are unique entry of malware like industroyer2 or attack that uses 
+  lolbin to download other file or payload to the infected machine. 
+search: '`wineventlog_security` EventCode=4698
+  | xmlkv Message
+  | search Hidden = true
+  | stats count min(_time) as firstTime max(_time) as lastTime by  Task_Name, Command, Author, Hidden, dest
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_hidden_schedule_task_settings_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
+  filter known instances of Task schedule used in your environment.
+known_false_positives: unknown
+references:
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+- https://cert.gov.ua/article/39518
+tags:
+  analytic_story:
+  - Industroyer2
+  - Active Directory Discovery
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/hidden_schedule_task/security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: A schedule task with hidden setting enable in host $dest$
+  mitre_attack_id:
+  - T1053
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - Task_Name
+  - Command
+  - Author
+  - Enabled
+  - Hidden
+  - Arguments
+  risk_score: 64
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_hidden_schedule_task_settings.test.yml b/tests/endpoint/windows_hidden_schedule_task_settings.test.yml
new file mode 100644
index 0000000000..aae5a924b5
--- /dev/null
+++ b/tests/endpoint/windows_hidden_schedule_task_settings.test.yml
@@ -0,0 +1,12 @@
+name: Windows Hidden Schedule Task Settings Unit Test
+tests:
+- name: Windows Hidden Schedule Task Settings
+  file: endpoint/windows_hidden_schedule_task_settings.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/hidden_schedule_task/security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog

From 00515112d1ec08364001600b125d967db4252b67 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 28 Apr 2022 09:05:31 +0200
Subject: [PATCH 02/14] industroyer2_PR3

---
 detections/endpoint/recon_using_wmi_class.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml
index 2cccbb268a..7997fc0342 100644
--- a/detections/endpoint/recon_using_wmi_class.yml
+++ b/detections/endpoint/recon_using_wmi_class.yml
@@ -27,10 +27,12 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
 tags:
   analytic_story:
   - Hermetic Wiper 
   - Malicious PowerShell
+  - Industroyer2
   confidence: 80
   context:
   - Source:Endpoint

From dc43dd29f747d2ec630267520e44cc419e10f1d6 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 28 Apr 2022 09:18:58 +0200
Subject: [PATCH 03/14] industroyer2_PR3

---
 ...ocesses_killed_by_industroyer2_malware.yml | 71 +++++++++++++++++++
 ...es_killed_by_industroyer2_malware.test.yml | 12 ++++
 2 files changed, 83 insertions(+)
 create mode 100644 detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml
 create mode 100644 tests/endpoint/windows_processes_killed_by_industroyer2_malware.test.yml

diff --git a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml
new file mode 100644
index 0000000000..98ecf5800b
--- /dev/null
+++ b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml
@@ -0,0 +1,71 @@
+name: Windows Processes Killed By Industroyer2 Malware
+id: d8bea5ca-9d4a-4249-8b56-64a619109835
+version: 1
+date: '2022-04-22'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic is to look for known processes killed by industroyer2 malware. 
+  This technique was seen in industroyer2 malware attack that tries kill several processes of windows host machine 
+  related to energy facility network. This anomaly might be a good indicator to check which process kill these processes or 
+  why the process was killed.
+search: '`sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") 
+  | stats min(_time) as firstTime max(_time) as lastTime count by process_name process process_path process_guid process_id EventCode dest user_id
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` 
+  | `windows_processes_killed_by_industroyer2_malware_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
+  required.
+known_false_positives: False positives are possible if legitimate applications are
+  allowed to terminate this process during testing or updates. Filter as needed based on paths that
+  are used legitimately.
+references:
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+tags:
+  analytic_story:
+  - Industroyer2
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/industroyer2/sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: process was terminated $process_name$ in $dest$
+  mitre_attack_id:
+  - T1489
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.process_guid
+  risk_score: 36
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_processes_killed_by_industroyer2_malware.test.yml b/tests/endpoint/windows_processes_killed_by_industroyer2_malware.test.yml
new file mode 100644
index 0000000000..cc07733705
--- /dev/null
+++ b/tests/endpoint/windows_processes_killed_by_industroyer2_malware.test.yml
@@ -0,0 +1,12 @@
+name: Windows Processes Killed By Industroyer2 Malware Unit Test
+tests:
+- name: Windows Processes Killed By Industroyer2 Malware
+  file: endpoint/windows_processes_killed_by_industroyer2_malware.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/industroyer2/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From e918be1f5924d9f745355d8650578333360e2d9c Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 28 Apr 2022 09:31:33 +0200
Subject: [PATCH 04/14] Update
 windows_processes_killed_by_industroyer2_malware.yml

---
 .../windows_processes_killed_by_industroyer2_malware.yml    | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml
index 98ecf5800b..fc55d84a0a 100644
--- a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml
+++ b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml
@@ -7,9 +7,9 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: The following analytic is to look for known processes killed by industroyer2 malware. 
-  This technique was seen in industroyer2 malware attack that tries kill several processes of windows host machine 
-  related to energy facility network. This anomaly might be a good indicator to check which process kill these processes or 
-  why the process was killed.
+  This technique was seen in the industroyer2 malware attack that tries to kill several processes 
+  of windows host machines related to the energy facility network. This anomaly might be a good 
+  indicator to check which process kill these processes or why the process was killed.
 search: '`sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") 
   | stats min(_time) as firstTime max(_time) as lastTime count by process_name process process_path process_guid process_id EventCode dest user_id
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` 

From 6c26474b2c271e66f6fcad89d1f0d9f74378cb8f Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 28 Apr 2022 10:39:40 +0200
Subject: [PATCH 05/14] industroyer2_PR3

---
 ...dows_linked_policies_in_adsi_discovery.yml | 65 +++++++++++++++++++
 ..._root_domain_linked_policies_discovery.yml | 65 +++++++++++++++++++
 ...linked_policies_in_adsi_discovery.test.yml | 12 ++++
 ..._domain_linked_policies_discovery.test.yml | 12 ++++
 4 files changed, 154 insertions(+)
 create mode 100644 detections/endpoint/windows_linked_policies_in_adsi_discovery.yml
 create mode 100644 detections/endpoint/windows_root_domain_linked_policies_discovery.yml
 create mode 100644 tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
 create mode 100644 tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml

diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml
new file mode 100644
index 0000000000..b04435a794
--- /dev/null
+++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml
@@ -0,0 +1,65 @@
+name: Windows Linked Policies In ADSI Discovery
+id: 510ea428-4731-4d2f-8829-a28293e427aa
+version: 1
+date: '2022-04-25'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
+  for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
+  domain organizational unit for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_linked_policies_in_adsi_discovery_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+- https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81
+tags:
+  analytic_story:
+  - Industroyer2
+  - Active Directory Discovery
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml.log
+  impact: 50
+  kill_chain_phases:
+  - Reconnaissance
+  message: powershell process having commandline $Message$ for user enumeration
+  mitre_attack_id:
+  - T1087.002
+  - T1087
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ScriptBlockText
+  - Computer
+  - user_id
+  risk_score: 25
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml
new file mode 100644
index 0000000000..84eb8be3ab
--- /dev/null
+++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml
@@ -0,0 +1,65 @@
+name: Windows Root Domain linked policies Discovery
+id: 80ffaede-1f12-49d5-a86e-b4b599b68b3c
+version: 1
+date: '2022-04-25'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
+  for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
+  root domain linked policies for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*([ADSI]”$_”).gplink*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_root_domain_linked_policies_discovery_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+- https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81
+tags:
+  analytic_story:
+  - Industroyer2
+  - Active Directory Discovery
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml.log
+  impact: 50
+  kill_chain_phases:
+  - Reconnaissance
+  message: powershell process having commandline $Message$ for user enumeration
+  mitre_attack_id:
+  - T1087.002
+  - T1087
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ScriptBlockText
+  - Computer
+  - user_id
+  risk_score: 25
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
new file mode 100644
index 0000000000..014e40253d
--- /dev/null
+++ b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
@@ -0,0 +1,12 @@
+name: Windows Linked Policies In ADSI Discovery Unit Test
+tests:
+- name: Windows Linked Policies In ADSI Discovery
+  file: endpoint/windows_linked_policies_in_adsi_discovery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell-xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
new file mode 100644
index 0000000000..199f17742e
--- /dev/null
+++ b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
@@ -0,0 +1,12 @@
+name: Windows Root Domain linked policies Discovery Unit Test
+tests:
+- name: Windows Root Domain linked policies Discovery
+  file: endpoint/windows_root_domain_linked_policies_discovery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell-xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From abd4a762c95174caf922fdb73e1edceda8bb9110 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 28 Apr 2022 13:38:06 +0200
Subject: [PATCH 06/14] Update
 windows_linked_policies_in_adsi_discovery.test.yml

---
 .../windows_linked_policies_in_adsi_discovery.test.yml        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
index 014e40253d..6cc7208fa0 100644
--- a/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
+++ b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell-xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml.log
+  - file_name: windows-powershell-xml1.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

From 134688feb14155cce7cc4b802d119a6a5116ba59 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 28 Apr 2022 13:38:27 +0200
Subject: [PATCH 07/14] Update
 windows_linked_policies_in_adsi_discovery.test.yml

---
 .../windows_linked_policies_in_adsi_discovery.test.yml        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
index 6cc7208fa0..42dd391b30 100644
--- a/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
+++ b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell-xml1.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log
+  - file_name: windows-powershell-xml2.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

From 6a365a14f6bd4c4c473f497d17b0daca2c11bc9a Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 28 Apr 2022 14:00:08 +0200
Subject: [PATCH 08/14] Update
 windows_root_domain_linked_policies_discovery.test.yml

---
 .../windows_root_domain_linked_policies_discovery.test.yml    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
index 199f17742e..08b1b8de69 100644
--- a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
+++ b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell-xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml.log
+  - file_name: windows-powershell-xml2.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

From ec40177bd674200df87a6422b1b37e9b1678baf7 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 28 Apr 2022 14:00:39 +0200
Subject: [PATCH 09/14] Update
 windows_root_domain_linked_policies_discovery.test.yml

---
 .../windows_root_domain_linked_policies_discovery.test.yml    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
index 08b1b8de69..f039984948 100644
--- a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
+++ b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell-xml2.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log
+  - file_name: windows-powershell-xml1.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

From c175368af3ee8bd91e8499990d6cc722ad6df988 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 28 Apr 2022 14:25:13 +0200
Subject: [PATCH 10/14] industroyer2_PR3

---
 .../endpoint/windows_linked_policies_in_adsi_discovery.yml    | 2 +-
 .../windows_root_domain_linked_policies_discovery.yml         | 2 +-
 .../windows_linked_policies_in_adsi_discovery.test.yml        | 4 ++--
 .../windows_root_domain_linked_policies_discovery.test.yml    | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml
index b04435a794..e9ae4599fc 100644
--- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml
+++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml
@@ -36,7 +36,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log
   impact: 50
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml
index 84eb8be3ab..852a3107bb 100644
--- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml
+++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml
@@ -36,7 +36,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log
   impact: 50
   kill_chain_phases:
   - Reconnaissance
diff --git a/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
index 42dd391b30..f70553f5a5 100644
--- a/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
+++ b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
@@ -8,5 +8,5 @@ tests:
   attack_data:
   - file_name: windows-powershell-xml2.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
diff --git a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
index f039984948..8e2c266699 100644
--- a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
+++ b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
@@ -8,5 +8,5 @@ tests:
   attack_data:
   - file_name: windows-powershell-xml1.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

From 78b20f13ea7205495a957da907b6d79cafeefd32 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 28 Apr 2022 14:45:29 +0200
Subject: [PATCH 11/14] industroyer2_PR3

---
 .../windows_linked_policies_in_adsi_discovery.test.yml        | 4 ++--
 .../windows_root_domain_linked_policies_discovery.test.yml    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
index f70553f5a5..654efa9de2 100644
--- a/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
+++ b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml
@@ -8,5 +8,5 @@ tests:
   attack_data:
   - file_name: windows-powershell-xml2.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
index 8e2c266699..8c27e137ad 100644
--- a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
+++ b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
@@ -8,5 +8,5 @@ tests:
   attack_data:
   - file_name: windows-powershell-xml1.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog

From 6730a5bb6db799e5da8146e46fb3881dbed6875b Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 28 Apr 2022 15:09:26 +0200
Subject: [PATCH 12/14] Update
 windows_root_domain_linked_policies_discovery.test.yml

---
 .../windows_root_domain_linked_policies_discovery.test.yml    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
index 8c27e137ad..a358883074 100644
--- a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
+++ b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell-xml1.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log
+  - file_name: windows-powershell-xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog

From f914fcdf5d93641f33149d9f169aedad225e2cc6 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 28 Apr 2022 15:33:51 +0200
Subject: [PATCH 13/14] Update
 windows_root_domain_linked_policies_discovery.test.yml

---
 .../windows_root_domain_linked_policies_discovery.test.yml    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
index a358883074..8c27e137ad 100644
--- a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
+++ b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell-xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml.log
+  - file_name: windows-powershell-xml1.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog

From 445c217cc5490e8bf234de76c305454fef9602d5 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 28 Apr 2022 15:35:22 +0200
Subject: [PATCH 14/14] Update
 windows_root_domain_linked_policies_discovery.yml

---
 .../endpoint/windows_root_domain_linked_policies_discovery.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml
index 852a3107bb..be57e9229a 100644
--- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml
+++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml
@@ -10,7 +10,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
   for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
   root domain linked policies for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*([ADSI]”$_”).gplink*"
+search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*.gplink*"
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`