Branch was auto-updated.

detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml

@@ -40,6 +40,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  - Active Directory Privilege Escalation
   asset_type: Endpoint
   confidence: 50
   impact: 90

detections/endpoint/rubeus_command_line_parameters.yml

@@ -41,6 +41,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  - Active Directory Privilege Escalation
   asset_type: Endpoint
   confidence: 60
   impact: 60

detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml

@@ -52,6 +52,7 @@ tags:
   - Active Directory Discovery
   - Active Directory Kerberos Attacks
   - Malicious PowerShell
+  - Active Directory Privilege Escalation
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml

@@ -58,6 +58,7 @@ tags:
   analytic_story:
   - Active Directory Discovery
   - Active Directory Kerberos Attacks
+  - Active Directory Privilege Escalation
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/suspicious_computer_account_name_change.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - sAMAccountName Spoofing and Domain Controller Impersonation
+  - Active Directory Privilege Escalation
   asset_type: Endpoint
   confidence: 70
   cve:

detections/endpoint/suspicious_kerberos_service_ticket_request.yml

@@ -35,6 +35,7 @@ tags:
   analytic_story:
   - sAMAccountName Spoofing and Domain Controller Impersonation
   - Active Directory Kerberos Attacks
+  - Active Directory Privilege Escalation
   asset_type: Endpoint
   confidence: 60
   cve:

detections/endpoint/suspicious_ticket_granting_ticket_request.yml

@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - sAMAccountName Spoofing and Domain Controller Impersonation
   - Active Directory Kerberos Attacks
+  - Active Directory Privilege Escalation
   asset_type: Endpoint
   confidence: 60
   impact: 100

detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml

@@ -39,6 +39,7 @@ tags:
   analytic_story:
   - Active Directory Lateral Movement
   - Active Directory Kerberos Attacks
+  - Active Directory Privilege Escalation
   asset_type: Endpoint
   confidence: 60
   impact: 70

detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml

@@ -27,7 +27,7 @@ search: ' `wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$"
   | eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0) |
   `unusual_number_of_remote_endpoint_authentication_events_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  Windows Event Logs from domain controllers aas well as member servers and workstations.
+  Windows Event Logs from domain controllers as well as member servers and workstations.
   The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
   to be enabled.
 known_false_positives: An single endpoint authenticating to a large number of hosts
@@ -38,6 +38,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - Active Directory Privilege Escalation
   asset_type: Endpoint
   confidence: 60
   impact: 70

detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml

@@ -0,0 +1,65 @@
+name: Windows Administrative Shares Accessed On Multiple Hosts
+id: d92f2d95-05fb-48a7-910f-4d3d61ab8655
+version: 1
+date: '2023-03-23'
+author: Mauricio Velazco, Splunk
+type: TTP
+status: production
+data_source : []
+description: The following analytic leverages Event IDs 5140 or 5145 to identify a source computer accessing windows administrative shares (C$, Admin$ and IPC$ ) across a large number
+  remote endpoints. Specifically, the logic will trigger when a source endpoint accesses administrative shares across 30 or more target computers within a 5 minute timespan. This behavior could 
+  represent an adversary who is enumerating network shares across an Active Directory environment in the search for sensitive files, a common technique leveraged by red teamers and threat actors.
+  As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+search: ' `wineventlog_security` EventCode=5140 OR EventCode=5145 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$")
+  | bucket span=5m _time
+  | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(ShareName) as shares by _time, IpAddress, SubjectUserName, EventCode
+  | where unique_targets > 30
+  | `windows_administrative_shares_accessed_on_multiple_hosts_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting file share events.
+  The Advanced Security Audit policy setting `Audit Detailed File Share` or `Audit File Share` within `Object Access` need to be enabled.
+known_false_positives: An single endpoint accessing windows administrative shares across a large number of endpoints is not common behavior.
+  Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
+references:
+- https://attack.mitre.org/techniques/T1135/
+- https://en.wikipedia.org/wiki/Administrative_share
+- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/
+- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5140
+- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Active Directory Lateral Movement
+  asset_type: Endpoint
+  confidence: 80
+  impact: 70
+  message: $IpAddress$ accessed the IPC share on more than 30 endpoints in a timespan of 5 minutes.
+  mitre_attack_id:
+  - T1135
+  observable:
+  - name: host_targets
+    type: Endpoint
+    role:
+    - Victim
+  - name: IpAddress
+    type: Endpoint
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ShareName
+  - Computer
+  - IpAddress
+  - SubjectUserName
+  risk_score: 56
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/ipc_share_accessed/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_admon_default_group_policy_object_modified.yml

@@ -0,0 +1,61 @@
+name: Windows Admon Default Group Policy Object Modified
+id: 83458004-db60-4170-857d-8572f16f070b
+version: 1
+date: '2023-03-29'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source : []
+description: The following analytic leverages Splunks Admon to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain
+  two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment.
+  The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group 
+  policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs.
+search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy")
+  | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_admon_default_group_policy_object_modified_filter`'
+how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here
+  https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory
+known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1484/
+- https://attack.mitre.org/techniques/T1484/001
+- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/
+- https://adsecurity.org/?p=2716
+- https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 50
+  impact: 100
+  message: A default domain group policy was updated on $dcName$
+  mitre_attack_id:
+  - T1484
+  - T1484.001
+  observable:
+  - name: dcName
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - admonEventType
+  - objectCategory
+  - displayName
+  - gPCFileSysPath
+  - dcName
+  risk_score: 50
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log
+    source: ActiveDirectory
+    sourcetype: ActiveDirectory

detections/endpoint/windows_admon_group_policy_object_created.yml

@@ -0,0 +1,61 @@
+name: Windows Admon Group Policy Object Created
+id: 69201633-30d9-48ef-b1b6-e680805f0582
+version: 1
+date: '2023-04-06'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source : []
+description: The following analytic leverages Splunks Admon to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure 
+  applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or 
+  deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network.
+  Security teams should monitor the creation of new Group Policy Objects.
+search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber=0 displayName!="New Group Policy Object"
+  | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_admon_group_policy_object_created_filter`'
+how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here
+  https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory
+known_false_positives: Group Policy Objects are created as part of regular administrative operations, filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1484/
+- https://attack.mitre.org/techniques/T1484/001
+- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/
+- https://adsecurity.org/?p=2716
+- https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 50
+  impact: 100
+  message: A new group policy objected was created on $dcName$
+  mitre_attack_id:
+  - T1484
+  - T1484.001
+  observable:
+  - name: dcName
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - admonEventType
+  - objectCategory
+  - displayName
+  - gPCFileSysPath
+  - dcName
+  risk_score: 50
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-admon.log
+    source: ActiveDirectory
+    sourcetype: ActiveDirectory

detections/endpoint/windows_default_group_policy_object_modified.yml

@@ -0,0 +1,68 @@
+name: Windows Default Group Policy Object Modified
+id: fe6a6cc4-9e0d-4d66-bcf4-2c7f44860876
+version: 1
+date: '2023-03-28'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source : []
+description: The following analytic leverages Event ID 5136 to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain
+  two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment.
+  The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group 
+  policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs.
+search: ' `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=versionNumber (ObjectDN="CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=*" OR ObjectDN="CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=POLICIES,CN=SYSTEM,DC=*")
+  | stats min(_time) as firstTime max(_time) as lastTime by ObjectDN SubjectUserSid AttributeValue Computer DSName
+  | rename AttributeValue as versionNumber
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_default_group_policy_object_modified_filter`'
+how_to_implement: To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled.
+  Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default.
+  A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/.
+known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1484/
+- https://attack.mitre.org/techniques/T1484/001
+- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/
+- https://adsecurity.org/?p=2716
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 50
+  impact: 100
+  message: A default group policy object was modified on $Computer$ by $SubjectUserSid$
+  mitre_attack_id:
+  - T1484
+  - T1484.001
+  observable:
+  - name: SubjectUserSid
+    type: User
+    role:
+    - Attacker
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - EventCode
+  - ObjectClass
+  - AttributeLDAPDisplayName
+  - ObjectDN
+  - Computer
+  - DSName
+  - AttributeValue
+  - SubjectUserSid
+  risk_score: 50
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml

@@ -0,0 +1,74 @@
+name: Windows Default Group Policy Object Modified with GPME
+id: eaf688b3-bb8f-454d-b105-920a862cd8cb
+version: 1
+date: '2023-04-24'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source : []
+description: The following analytic leverages the Endpoint datamodel to identify the potential edition of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain
+  two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment.
+  The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group 
+  policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mmc.exe (Processes.process =*gpme.msc*) AND (Processes.process = "*31B2F340-016D-11D2-945F-00C04FB984F9*" OR Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*"  ) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_default_group_policy_object_modified_with_gpme_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1484/
+- https://attack.mitre.org/techniques/T1484/001
+- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/
+- https://adsecurity.org/?p=2716
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265969(v=ws.11)
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 50
+  impact: 100
+  message: A default group policy object was opened with Group Policy Manage Editor on $dest$
+  mitre_attack_id:
+  - T1484
+  - T1484.001
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 50
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_dnsadmins_new_member_added.yml

@@ -0,0 +1,59 @@
+name: Windows DnsAdmins New Member Added
+id: 27e600aa-77f8-4614-bc80-2662a67e2f48
+version: 1
+date: '2023-04-06'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source:
+- Windows_Security_4732.yml
+description: The following analytic leverages Event ID 4732 to identify the addition of a new member to the DnsAdmins group within Active Directory. . Members of the DnsAdmin group can manage
+  the DNS service which most of the times runs on the Domain Controller. By abusing legitimate DNS management functionality, a member of the DnsAdmins group can escalate privileges by
+  executing malicious code on a Domain Controller as SYSTEM. Security teams should monitor the modification of the DnsAdmins group and validate the changes are legitimate.
+search: ' `wineventlog_security` EventCode=4732 TargetUserName=DnsAdmins
+  | stats min(_time) as firstTime max(_time) as lastTime values(SubjectUserName) values(Computer) by MemberSid, TargetUserName
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_dnsadmins_new_member_added_filter`'
+how_to_implement: To successfully implement this search, Domain Controller events need to be ingested. The Advanced Security Audit policy setting `Audit Security Group Management`
+  within `Account Management` needs to be enabled.
+known_false_positives: New members can be added to the DnsAdmins group as part of legitimate administrative tasks. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1098/
+- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/from-dnsadmins-to-system-to-domain-compromise
+- https://www.hackingarticles.in/windows-privilege-escalation-dnsadmins-to-domainadmin/
+- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  asset_type: Endpoint
+  confidence: 50
+  impact: 80
+  message: A new member was added to the DnsAdmins group by $SubjectUserName$
+  mitre_attack_id:
+  - T1098
+  observable:
+  - name: SubjectUserName
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetUserName
+  - SubjectUserName
+  - Computer
+  - MemberSid
+  - TargetUserName
+  risk_score: 40
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dnsadmins_member_added/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_file_share_discovery_with_powerview.yml

@@ -0,0 +1,66 @@
+name: Windows File Share Discovery With Powerview
+id: a44c0be1-d7ab-41e4-92fd-aa9af4fe232c
+version: 1
+date: '2023-03-20'
+author: Mauricio Velazco, Splunk
+type: TTP
+status: production
+data_source:
+- Powershell 4104
+description: The following analytic identifies the use of the Invoke-ShareFinder PowerShell commandlet part of PowerView. This module obtains the list of all
+  active domain computers and lists the active shares on each computer. Network file shares in Active Directory environments may contain sensitive information
+  like backups, scripts, credentials, etc. Adversaries who have obtained a foothold in an AD network may leverage PowerView to identify secrets and leverage them 
+  for Privilege Escalation or Lateral Movement.
+search: '`powershell` EventCode=4104  (ScriptBlockText=Invoke-ShareFinder*)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_file_share_discovery_with_powerview_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.=
+known_false_positives: Security teams may leverage PowerView proactively to identify and remediate sensitive file shares. Filter as needed.
+references:
+- https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1
+- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/
+- https://attack.mitre.org/techniques/T1135/
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Active Directory Discovery
+  asset_type: Endpoint
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  impact: 60
+  message: Invoke-ShareFinder commandlet was executed on $Computer$
+  mitre_attack_id:
+  - T1135
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: UserID
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
+  risk_score: 48
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_findstr_gpp_discovery.yml

@@ -0,0 +1,73 @@
+name: Windows Findstr GPP Discovery
+id: 1631ac2d-f2a9-42fa-8a59-d6e210d472f5
+version: 1
+date: '2023-03-16'
+author: Mauricio Velazco, Splunk
+type: TTP
+status: production
+data_source: []
+description: The following analytic identifies the use of the findstr command employed to search for unsecured credentials Group Policy Preferences (GPP).
+  GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.
+  These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).
+  While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=findstr.exe AND Processes.process=*sysvol* AND Processes.process=*cpassword*)
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_findstr_gpp_discovery_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Administrators may leverage findstr to find passwords in GPO to validate exposure. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1552/006/
+- https://pentestlab.blog/2017/03/20/group-policy-preferences/
+- https://adsecurity.org/?p=2288 
+- https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/
+- https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  asset_type: Endpoint
+  confidence: 80
+  impact: 70
+  message: Findstr was executed to discover GPP credentials on $dest$
+  mitre_attack_id:
+  - T1552
+  - T1552.006
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user
+  - Processes.dest
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process_id 
+  - Processes.parent_process_id
+  - Processes.original_file_name 
+  risk_score: 56
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-security.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_group_policy_object_created.yml

@@ -0,0 +1,68 @@
+name: Windows Group Policy Object Created
+id: 23add2a8-ea22-4fd4-8bc0-8c0b822373a1
+version: 1
+date: '2023-03-27'
+author: Mauricio Velazco
+status: production
+type: TTP
+data_source : []
+description:  The following analytic leverages Event IDs 5136 and 51137 to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure 
+  applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or 
+  deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network.
+  Security teams should monitor the creation of new Group Policy Objects.
+search: ' `wineventlog_security` EventCode=5137 OR (EventCode=5136 AttributeValue!="New Group Policy Object" AND (AttributeLDAPDisplayName=displayName OR AttributeLDAPDisplayName=gPCFileSysPath) ) ObjectClass=groupPolicyContainer
+  | stats values(AttributeValue) as details values(SubjectUserSid) as User values(ObjectDN) as ObjectDN by ObjectGUID Computer
+  | eval GPO_Name = mvindex(details, 0)
+  | eval GPO_Path = mvindex(details, 1)
+  | fields - details
+  | `windows_group_policy_object_created_filter`'
+how_to_implement: To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled.
+  Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default.
+  A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/.
+known_false_positives: Group Policy Objects are created as part of regular administrative operations, filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1484/
+- https://attack.mitre.org/techniques/T1484/001
+- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/
+- https://adsecurity.org/?p=2716
+- https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-encrypts-windows-domains-using-group-policies/
+- https://www.varonis.com/blog/group-policy-objects
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 50
+  impact: 80
+  message: A new group policy objected was created by $User$
+  mitre_attack_id:
+  - T1484
+  - T1484.001
+  - T1078.002
+  observable:
+  - name: User
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - AttributeValue
+  - AttributeLDAPDisplayName
+  - ObjectClass
+  - SubjectUserSid
+  - ObjectDN
+  - ObjectGUID
+  - Computer
+  risk_score: 40
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml

@@ -0,0 +1,67 @@
+name: Windows Large Number of Computer Service Tickets Requested
+id: 386ad394-c9a7-4b4f-b66f-586252de20f0
+version: 1
+date: '2023-03-20'
+author: Mauricio Velazco, Splunk
+type: Anomaly
+status: production
+data_source:
+- Windows Security 4769
+description: The following analytic leverages Event ID 4769, `A Kerberos
+  service ticket was requested`, to identify more than 30 computer service
+  ticket requests from one source. When a domain joined endpoint connects to other remote
+  endpoint, it will first request a Kerberos Service Ticket with the computer name as the
+  Service Name. A user requesting a large number of computer service tickets
+  for different endpoints could represent malicious behavior like lateral movement,
+  malware staging, reconnaissance, etc.\
+
+  Active Directory environments can be very different depending on the organization. Users should test this detection and customize 
+  the arbitrary threshold as needed.
+
+search: ' `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$"
+  | bucket span=5m _time 
+  | stats dc(ServiceName) AS unique_targets values(ServiceName) as host_targets by _time, IpAddress, TargetUserName
+  | where unique_targets > 30
+  | `windows_large_number_of_computer_service_tickets_requested_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. 
+  The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: An single endpoint requesting a large number of kerberos service tickets is not common behavior.
+  Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
+references:
+- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/
+- https://attack.mitre.org/techniques/T1135/
+- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Active Directory Lateral Movement
+  asset_type: Endpoint
+  confidence: 50
+  impact: 60
+  message: A large number of kerberos computer service tickets were requested by $IpAddress$ within 5 minutes.
+  mitre_attack_id:
+  - T1135
+  - T1078
+  observable:
+  - name: IpAddress
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ServiceName
+  - TargetUserName
+  - IpAddress
+  risk_score: 30
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/large_number_computer_service_tickets/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_local_administrator_credential_stuffing.yml

@@ -0,0 +1,69 @@
+name: Windows Local Administrator Credential Stuffing
+id: 09555511-aca6-484a-b6ab-72cd03d73c34
+version: 1
+date: '2023-03-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+status: production
+data_source:
+- Windows Security 4624
+description: The following analytic leverages events 4625 and 4624 to identify an endpoint using the builtin local Administrator account to authenticate to a large numbers of endpoints. Specifically, 
+  the logic will trigger when an endpoints attempts to authenticate to more than 30 target computers within a 5 minute timespan. This behavior could
+  represent an adversary who has obtained access to local credentials and is trying to validate if these credentials work on other hosts to escalate their privileges.
+   As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+search: ' `wineventlog_security` EventCode=4625 OR EventCode=4624 Logon_Type=3 TargetUserName=Administrator
+  | bucket span=5m _time
+  | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName, EventCode
+  | where unique_targets > 30
+  | `windows_local_administrator_credential_stuffing_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers as well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+known_false_positives: Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1110/004/
+- https://attack.mitre.org/techniques/T1110/
+- https://www.blackhillsinfosec.com/wide-spread-local-admin-testing/
+- https://www.pentestpartners.com/security-blog/admin-password-re-use-dont-do-it/
+- https://www.praetorian.com/blog/microsofts-local-administrator-password-solution-laps/
+- https://wiki.porchetta.industries/smb-protocol/password-spraying
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Active Directory Lateral Movement
+  asset_type: Endpoint
+  confidence: 80
+  impact: 70
+  message: Local Administrator credential stuffing attack coming from $IpAddress$
+  mitre_attack_id:
+  - T1110
+  - T1110.004
+  observable:
+  - name: host_targets
+    type: Endpoint
+    role:
+    - Victim
+  - name: IpAddress
+    type: Endpoint
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Logon_Type
+  - TargetUserName
+  - Computer
+  - IpAddress
+  risk_score: 56
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_powersploit_gpp_discovery.yml

@@ -0,0 +1,66 @@
+name: Windows PowerSploit GPP Discovery
+id: 0130a0df-83a1-4647-9011-841e950ff302
+version: 1
+date: '2023-03-16'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source:
+- Powershell 4104
+description: The following analytic identifies the use of the Get-GPPPassword PowerShell commandlet employed to search for unsecured credentials Group Policy Preferences (GPP).
+  GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.
+  These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).
+  While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
+search: ' `powershell` EventCode=4104  (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_powersploit_gpp_discovery_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Unknown
+references:
+- https://attack.mitre.org/techniques/T1552/006/
+- https://pentestlab.blog/2017/03/20/group-policy-preferences/
+- https://adsecurity.org/?p=2288 
+- https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/
+- https://adsecurity.org/?p=2288
+- https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  asset_type: Endpoint
+  confidence: 80
+  impact: 70
+  message: Commandlets leveraged to discover GPP credentials were executed on $Computer$
+  mitre_attack_id:
+  - T1552
+  - T1552.006
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: UserID
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
+  risk_score: 56
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml

@@ -0,0 +1,62 @@
+name: Windows PowerView AD Access Control List Enumeration
+id: 39405650-c364-4e1e-a740-32a63ef042a6
+version: 1
+date: '2023-04-20'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source:
+- Powershell 4104
+description: The following analytic leverages Event ID 4104 to identify the execution of the PowerView powershell commandlets `Get-ObjectAcl` or `Get-DomainObjectAcl`. This commandlets
+  are used to enumerate Access Control List permissions given to Active Directory objects. In an active directory environment, an object is an entity that represents an available resource within 
+  the organizations network, such as domain controllers, users, groups, computers, shares, etc.  Maintaining Active Directory permissions is complicated and hard to manage, especially in complex 
+  and large environments with multiple domains. Weak permissions may allow adversaries and red teamers to escalate their privileges in Active Directory. PowerView is a common tool leveraged
+  by attackers to identify and exploit configuration weaknesses.
+search: ' `powershell` EventCode=4104  (ScriptBlockText=*get-objectacl* OR ScriptBlockText=*Get-DomainObjectAcl* )
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_powerview_ad_access_control_list_enumeration_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.=
+known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1078/002/
+- https://medium.com/r3d-buck3t/enumerating-access-controls-in-active-directory-c06e2efa8b89
+- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces
+- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainObjectAcl/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  - Active Directory Privilege Escalation
+  asset_type: Endpoint
+  confidence: 50
+  impact: 40
+  message: PowerView AD acccess control list enumeration detected on $Computer$
+  mitre_attack_id:
+  - T1078.002
+  - T1069
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ScriptBlockText
+  - Opcode
+  - UserID
+  risk_score: 20
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml

@@ -0,0 +1,65 @@
+name: Windows Rapid Authentication On Multiple Hosts
+id: 62606c77-d53d-4182-9371-b02cdbbbcef7
+version: 1
+date: '2023-03-23'
+author: Mauricio Velazco, Splunk
+type: TTP
+status: production
+data_source:
+- Windows  Security 4624
+description: The following analytic leverages Event ID 4624 to identify a source computer authenticating to a large number of remote endpoints within an Active Directory network.
+  Specifically, the logic will trigger when a source endpoint authenticates to 30 or more target computers within a 5 minute timespan. This behavior could represent an adversary who is
+  moving laterally across the environment or enumerating network shares in the search for sensitive files.
+  As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+search: '  `wineventlog_security` EventCode=4624 LogonType=3 TargetUserName!="ANONYMOUS LOGON" TargetUserName!="*$"
+  | bucket span=5m _time
+  | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName
+  | where unique_targets > 30
+  | `windows_rapid_authentication_on_multiple_hosts_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers as well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+known_false_positives: Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1135/
+- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/
+- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Active Directory Lateral Movement
+  asset_type: Endpoint
+  confidence: 80
+  impact: 60
+  message: The source computer with ip address $IpAddress$ authenticated to a large number of remote endpoints within 5 minutes.
+  mitre_attack_id:
+  - T1003.002
+  observable:
+  - name: host_targets
+    type: Endpoint
+    role:
+    - Victim
+  - name: IpAddress
+    type: Endpoint
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Logon_Type
+  - TargetUserName
+  - Computer
+  - IpAddress
+  risk_score: 48
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/windows-security.log  
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml

@@ -0,0 +1,65 @@
+name: Windows Special Privileged Logon On Multiple Hosts
+id: 4c461f5a-c2cc-4e86-b132-c262fc9edca7
+version: 1
+date: '2023-03-27'
+author: Mauricio Velazco, Splunk
+type: TTP
+status: production
+data_source : []
+description: The following analytic leverages Event ID 4672 to identify a source user authenticating with special privileges across a large number
+  remote endpoints. Specifically, the logic will trigger when a source user obtains special privileges across 30 or more target computers within a 5 minute timespan.
+  Special privileges are assigned to a new logon session when sensitive privileges like SeDebugPrivilege and SeImpersonatePrivilege are assigned. This behavior could represent an 
+  adversary who is moving laterally and executing remote code across the network. It can also be triggered by other behavior like an adversary enumerating network shares.
+  As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+search: ' `wineventlog_security` EventCode=4672 AND NOT(Caller_User_Name IN ("DWM-1","DWM-2","DWM-3","LOCAL SERVICE","NETWORK SERVICE","SYSTEM","*$"))
+  | bucket span=5m _time
+  | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(PrivilegeList) as privileges by _time, Caller_User_Name
+  | where unique_targets > 30
+  | `windows_special_privileged_logon_on_multiple_hosts_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting special logon events.
+  The Advanced Security Audit policy setting `Audit Special Logon` within `Logon/Logoff` need to be enabled.
+known_false_positives: Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed.
+references:
+- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319113(v=ws.11)
+- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/
+- https://attack.mitre.org/tactics/TA0008/
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Active Directory Lateral Movement
+  asset_type: Endpoint
+  confidence: 80
+  impact: 80
+  message: A source user $Caller_User_Name$ obtained special privileges on a large number of endpoints within 5 minutes.
+  mitre_attack_id:
+  - T1087
+  - T1021.002
+  - T1135
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: Caller_User_Name
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Caller_User_Name
+  - Computer
+  - PrivilegeList
+  risk_score: 64
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/special_logon_on_mulitple_hosts/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-20T19:56:47 UTC
+# On Date: 2023-04-24T21:58:20 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -8930,7 +8930,7 @@ asset_type = Endpoint
 confidence = medium
 explanation = The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, to identify an unusual number of remote authentication attempts coming from one source. An endpoint authenticating to a large number of remote endpoints could represent malicious behavior like lateral movement, malware staging, reconnaissance, etc.\
 The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual high number of authentication events. To customize this analytic, users can try different combinations of the `bucket` span time,  the calculation of the `upperBound` field as well as the Outlier calculation. This logic can be used for real time security monitoring as well as threat hunting exercises.\
-how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
+how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
 annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078"], "nist": ["DE.AE"]}
 known_false_positives = An single endpoint authenticating to a large number of hosts is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, jump servers and missconfigured systems.
 providing_technologies = ["Microsoft Windows"]
@@ -9275,6 +9275,36 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = administrators rarely use adfind, usually not used for legitimate reasons
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Administrative Shares Accessed On Multiple Hosts - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages Event IDs 5140 or 5145 to identify a source computer accessing windows administrative shares (C$, Admin$ and IPC$ ) across a large number remote endpoints. Specifically, the logic will trigger when a source endpoint accesses administrative shares across 30 or more target computers within a 5 minute timespan. This behavior could represent an adversary who is enumerating network shares across an Active Directory environment in the search for sensitive files, a common technique leveraged by red teamers and threat actors. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+how_to_implement = To successfully implement this search, you need to be ingesting file share events. The Advanced Security Audit policy setting `Audit Detailed File Share` or `Audit File Share` within `Object Access` need to be enabled.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1135"], "nist": ["DE.CM"]}
+known_false_positives = An single endpoint accessing windows administrative shares across a large number of endpoints is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
+providing_technologies = ["Microsoft Windows"]
+
+[savedsearch://ESCU - Windows Admon Default Group Policy Object Modified - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages Splunks Admon to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs.
+how_to_implement = To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+known_false_positives = The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Windows Admon Group Policy Object Created - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages Splunks Admon to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network. Security teams should monitor the creation of new Group Policy Objects.
+how_to_implement = To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+known_false_positives = Group Policy Objects are created as part of regular administrative operations, filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Windows Apache Benchmark Binary - Rule]
 type = detection
 asset_type = Endpoint
@@ -9551,6 +9581,26 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = 3rd part software application can change the wallpaper. Filter is needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Default Group Policy Object Modified - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages Event ID 5136 to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs.
+how_to_implement = To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled. Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default. A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+known_false_positives = The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
+[savedsearch://ESCU - Windows Default Group Policy Object Modified with GPME - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages the Endpoint datamodel to identify the potential edition of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+known_false_positives = The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Defender Exclusion Registry Entry - Rule]
 type = detection
 asset_type = Endpoint
@@ -9751,6 +9801,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Reconnaissance"], "mi
 known_false_positives = network administrator can execute this command to enumerate DNS record. Filter or add other paths to the exclusion as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows DnsAdmins New Member Added - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages Event ID 4732 to identify the addition of a new member to the DnsAdmins group within Active Directory. . Members of the DnsAdmin group can manage the DNS service which most of the times runs on the Domain Controller. By abusing legitimate DNS management functionality, a member of the DnsAdmins group can escalate privileges by executing malicious code on a Domain Controller as SYSTEM. Security teams should monitor the modification of the DnsAdmins group and validate the changes are legitimate.
+how_to_implement = To successfully implement this search, Domain Controller events need to be ingested. The Advanced Security Audit policy setting `Audit Security Group Management` within `Account Management` needs to be enabled.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
+known_false_positives = New members can be added to the DnsAdmins group as part of legitimate administrative tasks. Filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
 [savedsearch://ESCU - Windows DotNet Binary in Non Standard Path - Rule]
 type = detection
 asset_type = Endpoint
@@ -9881,6 +9941,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = False positives may be generated based on an automated process or service that exports certificates on the regular. Review is required before setting to alert. Monitor for abnormal processes performing an export.
 providing_technologies = null
 
+[savedsearch://ESCU - Windows File Share Discovery With Powerview - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the use of the Invoke-ShareFinder PowerShell commandlet part of PowerView. This module obtains the list of all active domain computers and lists the active shares on each computer. Network file shares in Active Directory environments may contain sensitive information like backups, scripts, credentials, etc. Adversaries who have obtained a foothold in an AD network may leverage PowerView to identify secrets and leverage them for Privilege Escalation or Lateral Movement.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.=
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1135"], "nist": ["DE.CM"]}
+known_false_positives = Security teams may leverage PowerView proactively to identify and remediate sensitive file shares. Filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
 [savedsearch://ESCU - Windows File Transfer Protocol In Non-Common Process Path - Rule]
 type = detection
 asset_type = Endpoint
@@ -9901,6 +9971,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = Unknown at this point
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Findstr GPP Discovery - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the use of the findstr command employed to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552", "T1552.006"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may leverage findstr to find passwords in GPO to validate exposure. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Gather Victim Host Information Camera - Rule]
 type = detection
 asset_type = Endpoint
@@ -9941,6 +10021,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = Administrators or power users may leverage PowerView for system management or troubleshooting.
 providing_technologies = ["Microsoft Windows"]
 
+[savedsearch://ESCU - Windows Group Policy Object Created - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages Event IDs 5136 and 51137 to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network. Security teams should monitor the creation of new Group Policy Objects.
+how_to_implement = To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled. Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default. A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1484", "T1484.001", "T1078.002"], "nist": ["DE.CM"]}
+known_false_positives = Group Policy Objects are created as part of regular administrative operations, filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
 [savedsearch://ESCU - Windows Hidden Schedule Task Settings - Rule]
 type = detection
 asset_type = Endpoint
@@ -10278,6 +10368,17 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Explo
 known_false_positives = False positives should be limited as this is specific to KrbRelayUp based attack. Filter as needed.
 providing_technologies = null
 
+[savedsearch://ESCU - Windows Large Number of Computer Service Tickets Requested - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, to identify more than 30 computer service ticket requests from one source. When a domain joined endpoint connects to other remote endpoint, it will first request a Kerberos Service Ticket with the computer name as the Service Name. A user requesting a large number of computer service tickets for different endpoints could represent malicious behavior like lateral movement, malware staging, reconnaissance, etc.\
+Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold as needed.
+how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1135", "T1078"], "nist": ["DE.AE"]}
+known_false_positives = An single endpoint requesting a large number of kerberos service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
+providing_technologies = ["Microsoft Windows"]
+
 [savedsearch://ESCU - Windows Lateral Tool Transfer RemCom - Rule]
 type = detection
 asset_type = Endpoint
@@ -10298,6 +10399,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = Administrators or power users may use this command for troubleshooting.
 providing_technologies = ["Microsoft Windows"]
 
+[savedsearch://ESCU - Windows Local Administrator Credential Stuffing - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages events 4625 and 4624 to identify an endpoint using the builtin local Administrator account to authenticate to a large numbers of endpoints. Specifically, the logic will trigger when an endpoints attempts to authenticate to more than 30 target computers within a 5 minute timespan. This behavior could represent an adversary who has obtained access to local credentials and is trying to validate if these credentials work on other hosts to escalate their privileges. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110", "T1110.004"], "nist": ["DE.CM"]}
+known_false_positives = Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
 [savedsearch://ESCU - Windows Mail Protocol In Non-Common Process Path - Rule]
 type = detection
 asset_type = Endpoint
@@ -10848,6 +10959,26 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitr
 known_false_positives = False positives may be present based on legacy applications or utilities. Win32_ScheduledJob uses the Remote Procedure Call (RPC) protocol to create scheduled tasks on remote computers. It uses the DCOM (Distributed Component Object Model) infrastructure to establish a connection with the remote computer and invoke the necessary methods. The RPC service needs to be running on both the local and remote computers for the communication to take place.
 providing_technologies = ["Microsoft Windows"]
 
+[savedsearch://ESCU - Windows PowerSploit GPP Discovery - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the use of the Get-GPPPassword PowerShell commandlet employed to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552", "T1552.006"], "nist": ["DE.CM"]}
+known_false_positives = Unknown
+providing_technologies = ["Microsoft Windows"]
+
+[savedsearch://ESCU - Windows PowerView AD Access Control List Enumeration - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages Event ID 4104 to identify the execution of the PowerView powershell commandlets `Get-ObjectAcl` or `Get-DomainObjectAcl`. This commandlets are used to enumerate Access Control List permissions given to Active Directory objects. In an active directory environment, an object is an entity that represents an available resource within the organizations network, such as domain controllers, users, groups, computers, shares, etc.  Maintaining Active Directory permissions is complicated and hard to manage, especially in complex and large environments with multiple domains. Weak permissions may allow adversaries and red teamers to escalate their privileges in Active Directory. PowerView is a common tool leveraged by attackers to identify and exploit configuration weaknesses.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.=
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078.002", "T1069"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may leverage PowerView for legitimate purposes, filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
 [savedsearch://ESCU - Windows PowerView Constrained Delegation Discovery - Rule]
 type = detection
 asset_type = Endpoint
@@ -10998,6 +11129,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = False positives should be limited, however filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Rapid Authentication On Multiple Hosts - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages Event ID 4624 to identify a source computer authenticating to a large number of remote endpoints within an Active Directory network. Specifically, the logic will trigger when a source endpoint authenticates to 30 or more target computers within a 5 minute timespan. This behavior could represent an adversary who is moving laterally across the environment or enumerating network shares in the search for sensitive files. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]}
+known_false_positives = Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
 [savedsearch://ESCU - Windows Rasautou DLL Execution - Rule]
 type = detection
 asset_type = Endpoint
@@ -11418,6 +11559,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_at
 known_false_positives = No false positives known. Filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Special Privileged Logon On Multiple Hosts - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages Event ID 4672 to identify a source user authenticating with special privileges across a large number remote endpoints. Specifically, the logic will trigger when a source user obtains special privileges across 30 or more target computers within a 5 minute timespan. Special privileges are assigned to a new logon session when sensitive privileges like SeDebugPrivilege and SeImpersonatePrivilege are assigned. This behavior could represent an adversary who is moving laterally and executing remote code across the network. It can also be triggered by other behavior like an adversary enumerating network shares. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+how_to_implement = To successfully implement this search, you need to be ingesting special logon events. The Advanced Security Audit policy setting `Audit Special Logon` within `Logon/Logoff` need to be enabled.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087", "T1021.002", "T1135"], "nist": ["DE.CM"]}
+known_false_positives = Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
 [savedsearch://ESCU - Windows Steal Authentication Certificates Certificate Issued - Rule]
 type = detection
 asset_type = Endpoint
@@ -12719,7 +12870,7 @@ version = 1
 references = ["https://attack.mitre.org/tactics/TA0007/", "https://adsecurity.org/?p=2535", "https://attack.mitre.org/techniques/T1087/001/", "https://attack.mitre.org/techniques/T1087/002/", "https://attack.mitre.org/techniques/T1087/003/", "https://attack.mitre.org/techniques/T1482/", "https://attack.mitre.org/techniques/T1201/", "https://attack.mitre.org/techniques/T1069/001/", "https://attack.mitre.org/techniques/T1069/002/", "https://attack.mitre.org/techniques/T1018/", "https://attack.mitre.org/techniques/T1049/", "https://attack.mitre.org/techniques/T1033/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
 spec_version = 3
-searches = ["ESCU - AdsiSearcher Account Discovery - Rule", "ESCU - Domain Account Discovery with Dsquery - Rule", "ESCU - Domain Account Discovery With Net App - Rule", "ESCU - Domain Account Discovery with Wmic - Rule", "ESCU - Domain Controller Discovery with Nltest - Rule", "ESCU - Domain Controller Discovery with Wmic - Rule", "ESCU - Domain Group Discovery with Adsisearcher - Rule", "ESCU - Domain Group Discovery With Dsquery - Rule", "ESCU - Domain Group Discovery With Net - Rule", "ESCU - Domain Group Discovery With Wmic - Rule", "ESCU - DSQuery Domain Discovery - Rule", "ESCU - Elevated Group Discovery With Net - Rule", "ESCU - Elevated Group Discovery with PowerView - Rule", "ESCU - Elevated Group Discovery With Wmic - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get ADUser with PowerShell - Rule", "ESCU - Get ADUser with PowerShell Script Block - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainPolicy with Powershell - Rule", "ESCU - Get DomainPolicy with Powershell Script Block - Rule", "ESCU - Get-DomainTrust with PowerShell - Rule", "ESCU - Get-DomainTrust with PowerShell Script Block - Rule", "ESCU - Get DomainUser with PowerShell - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get-ForestTrust with PowerShell - Rule", "ESCU - Get-ForestTrust with PowerShell Script Block - Rule", "ESCU - Get WMIObject Group Discovery - Rule", "ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule", "ESCU - GetAdComputer with PowerShell - Rule", "ESCU - GetAdComputer with PowerShell Script Block - Rule", "ESCU - GetAdGroup with PowerShell - Rule", "ESCU - GetAdGroup with PowerShell Script Block - Rule", "ESCU - GetCurrent User with PowerShell - Rule", "ESCU - GetCurrent User with PowerShell Script Block - Rule", "ESCU - GetDomainComputer with PowerShell - Rule", "ESCU - GetDomainComputer with PowerShell Script Block - Rule", "ESCU - GetDomainController with PowerShell - Rule", "ESCU - GetDomainController with PowerShell Script Block - Rule", "ESCU - GetDomainGroup with PowerShell - Rule", "ESCU - GetDomainGroup with PowerShell Script Block - Rule", "ESCU - GetLocalUser with PowerShell - Rule", "ESCU - GetLocalUser with PowerShell Script Block - Rule", "ESCU - GetNetTcpconnection with PowerShell - Rule", "ESCU - GetNetTcpconnection with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Group with PowerShell - Rule", "ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule", "ESCU - GetWmiObject DS User with PowerShell - Rule", "ESCU - GetWmiObject DS User with PowerShell Script Block - Rule", "ESCU - GetWmiObject User Account with PowerShell - Rule", "ESCU - GetWmiObject User Account with PowerShell Script Block - Rule", "ESCU - Local Account Discovery with Net - Rule", "ESCU - Local Account Discovery With Wmic - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Net - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Network Discovery Using Route Windows App - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Password Policy Discovery with Net - Rule", "ESCU - PowerShell Get LocalGroup Discovery - Rule", "ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule", "ESCU - Remote System Discovery with Adsisearcher - Rule", "ESCU - Remote System Discovery with Dsquery - Rule", "ESCU - Remote System Discovery with Net - Rule", "ESCU - Remote System Discovery with Wmic - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - System User Discovery With Query - Rule", "ESCU - System User Discovery With Whoami - Rule", "ESCU - User Discovery With Env Vars PowerShell - Rule", "ESCU - User Discovery With Env Vars PowerShell Script Block - Rule", "ESCU - Windows Hidden Schedule Task Settings - Rule", "ESCU - Windows Lateral Tool Transfer RemCom - Rule", "ESCU - Windows Linked Policies In ADSI Discovery - Rule", "ESCU - Windows Root Domain linked policies Discovery - Rule", "ESCU - Windows Service Create RemComSvc - Rule", "ESCU - Wmic Group Discovery - Rule"]
+searches = ["ESCU - AdsiSearcher Account Discovery - Rule", "ESCU - Domain Account Discovery with Dsquery - Rule", "ESCU - Domain Account Discovery With Net App - Rule", "ESCU - Domain Account Discovery with Wmic - Rule", "ESCU - Domain Controller Discovery with Nltest - Rule", "ESCU - Domain Controller Discovery with Wmic - Rule", "ESCU - Domain Group Discovery with Adsisearcher - Rule", "ESCU - Domain Group Discovery With Dsquery - Rule", "ESCU - Domain Group Discovery With Net - Rule", "ESCU - Domain Group Discovery With Wmic - Rule", "ESCU - DSQuery Domain Discovery - Rule", "ESCU - Elevated Group Discovery With Net - Rule", "ESCU - Elevated Group Discovery with PowerView - Rule", "ESCU - Elevated Group Discovery With Wmic - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get ADUser with PowerShell - Rule", "ESCU - Get ADUser with PowerShell Script Block - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainPolicy with Powershell - Rule", "ESCU - Get DomainPolicy with Powershell Script Block - Rule", "ESCU - Get-DomainTrust with PowerShell - Rule", "ESCU - Get-DomainTrust with PowerShell Script Block - Rule", "ESCU - Get DomainUser with PowerShell - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get-ForestTrust with PowerShell - Rule", "ESCU - Get-ForestTrust with PowerShell Script Block - Rule", "ESCU - Get WMIObject Group Discovery - Rule", "ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule", "ESCU - GetAdComputer with PowerShell - Rule", "ESCU - GetAdComputer with PowerShell Script Block - Rule", "ESCU - GetAdGroup with PowerShell - Rule", "ESCU - GetAdGroup with PowerShell Script Block - Rule", "ESCU - GetCurrent User with PowerShell - Rule", "ESCU - GetCurrent User with PowerShell Script Block - Rule", "ESCU - GetDomainComputer with PowerShell - Rule", "ESCU - GetDomainComputer with PowerShell Script Block - Rule", "ESCU - GetDomainController with PowerShell - Rule", "ESCU - GetDomainController with PowerShell Script Block - Rule", "ESCU - GetDomainGroup with PowerShell - Rule", "ESCU - GetDomainGroup with PowerShell Script Block - Rule", "ESCU - GetLocalUser with PowerShell - Rule", "ESCU - GetLocalUser with PowerShell Script Block - Rule", "ESCU - GetNetTcpconnection with PowerShell - Rule", "ESCU - GetNetTcpconnection with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Group with PowerShell - Rule", "ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule", "ESCU - GetWmiObject DS User with PowerShell - Rule", "ESCU - GetWmiObject DS User with PowerShell Script Block - Rule", "ESCU - GetWmiObject User Account with PowerShell - Rule", "ESCU - GetWmiObject User Account with PowerShell Script Block - Rule", "ESCU - Local Account Discovery with Net - Rule", "ESCU - Local Account Discovery With Wmic - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Net - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Network Discovery Using Route Windows App - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Password Policy Discovery with Net - Rule", "ESCU - PowerShell Get LocalGroup Discovery - Rule", "ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule", "ESCU - Remote System Discovery with Adsisearcher - Rule", "ESCU - Remote System Discovery with Dsquery - Rule", "ESCU - Remote System Discovery with Net - Rule", "ESCU - Remote System Discovery with Wmic - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - System User Discovery With Query - Rule", "ESCU - System User Discovery With Whoami - Rule", "ESCU - User Discovery With Env Vars PowerShell - Rule", "ESCU - User Discovery With Env Vars PowerShell Script Block - Rule", "ESCU - Windows File Share Discovery With Powerview - Rule", "ESCU - Windows Hidden Schedule Task Settings - Rule", "ESCU - Windows Lateral Tool Transfer RemCom - Rule", "ESCU - Windows Linked Policies In ADSI Discovery - Rule", "ESCU - Windows PowerView AD Access Control List Enumeration - Rule", "ESCU - Windows Root Domain linked policies Discovery - Rule", "ESCU - Windows Service Create RemComSvc - Rule", "ESCU - Wmic Group Discovery - Rule"]
 description = Monitor for activities and techniques associated with Discovery and Reconnaissance within with Active Directory environments.
 narrative = Discovery consists of techniques an adversay uses to gain knowledge about an internal environment or network. These techniques provide adversaries with situational awareness and allows them to have the necessary information before deciding how to act or who/what to target next.\
 Once an attacker obtains an initial foothold in an Active Directory environment, she is forced to engage in Discovery techniques in the initial phases of a breach to better understand and navigate the target network. Some examples include but are not limited to enumerating domain users, domain admins, computers, domain controllers, network shares, group policy objects, domain trusts, etc.
@@ -12742,7 +12893,7 @@ version = 3
 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html", "http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco"]
 maintainers = [{"company": "Mauricio Velazco Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell Invoke CIMMethod CIMSession - Rule", "ESCU - PowerShell Start or Stop Service - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Randomly Generated Windows Service Name - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and Winrs - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Windows Enable Win32 ScheduledJob via Registry - Rule", "ESCU - Windows PowerShell Get CIMInstance Remote Computer - Rule", "ESCU - Windows PowerShell WMI Win32 ScheduledJob - Rule", "ESCU - Windows RDP Connection Successful - Rule", "ESCU - Windows Remote Create Service - Rule", "ESCU - Windows Service Create with Tscon - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Service Creation on Remote Endpoint - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Initiation on Remote Endpoint - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule", "ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
+searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell Invoke CIMMethod CIMSession - Rule", "ESCU - PowerShell Start or Stop Service - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Randomly Generated Windows Service Name - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and Winrs - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Windows Administrative Shares Accessed On Multiple Hosts - Rule", "ESCU - Windows Enable Win32 ScheduledJob via Registry - Rule", "ESCU - Windows Large Number of Computer Service Tickets Requested - Rule", "ESCU - Windows Local Administrator Credential Stuffing - Rule", "ESCU - Windows PowerShell Get CIMInstance Remote Computer - Rule", "ESCU - Windows PowerShell WMI Win32 ScheduledJob - Rule", "ESCU - Windows Rapid Authentication On Multiple Hosts - Rule", "ESCU - Windows RDP Connection Successful - Rule", "ESCU - Windows Remote Create Service - Rule", "ESCU - Windows Service Create with Tscon - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Service Creation on Remote Endpoint - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Initiation on Remote Endpoint - Rule", "ESCU - Windows Special Privileged Logon On Multiple Hosts - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule", "ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
 description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement is often a necessary step in a breach, it is important for cyber defenders to deploy detection coverage.
 narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\
 Indications of lateral movement in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager, the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\
@@ -12763,6 +12914,17 @@ narrative = In a password spraying attack, adversaries leverage one or a small l
 Password Spraying can be leveraged by adversaries across different stages in an attack. It can be used to obtain an iniial access to an environment but can also be used to escalate privileges when access has been already achieved. In some scenarios, this technique capitalizes on a security policy most organizations implement, password rotation. As enterprise users change their passwords, it is possible some pick predictable, seasonal passwords such as `$CompanyNameWinter`, `Summer2021`, etc.\
 Specifically, this Analytic Story is focused on detecting possible Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents 16 detection analytics which can aid defenders in identifying instances where one source user, source host or source process attempts to authenticate against a target or targets using a high or statiscally unsual, number of unique users. A user, host or process attempting to authenticate with multiple users is not common behavior for legitimate systems and should be monitored by security teams. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, multi-user systems and missconfigured systems. These should be easily spotted when first implementing the detection and addded to an allow list or lookup table. The presented detections can also be used in Threat Hunting exercises.
 
+[analytic_story://Active Directory Privilege Escalation]
+category = 
+last_updated = 2023-03-20
+version = 1
+references = []
+maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
+spec_version = 3
+searches = ["ESCU - Kerberos Service Ticket Request Using RC4 Encryption - Rule", "ESCU - Rubeus Command Line Parameters - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - Suspicious Computer Account Name Change - Rule", "ESCU - Suspicious Kerberos Service Ticket Request - Rule", "ESCU - Suspicious Ticket Granting Ticket Request - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Windows Administrative Shares Accessed On Multiple Hosts - Rule", "ESCU - Windows Admon Default Group Policy Object Modified - Rule", "ESCU - Windows Admon Group Policy Object Created - Rule", "ESCU - Windows Default Group Policy Object Modified - Rule", "ESCU - Windows Default Group Policy Object Modified with GPME - Rule", "ESCU - Windows DnsAdmins New Member Added - Rule", "ESCU - Windows File Share Discovery With Powerview - Rule", "ESCU - Windows Findstr GPP Discovery - Rule", "ESCU - Windows Group Policy Object Created - Rule", "ESCU - Windows Large Number of Computer Service Tickets Requested - Rule", "ESCU - Windows Local Administrator Credential Stuffing - Rule", "ESCU - Windows PowerSploit GPP Discovery - Rule", "ESCU - Windows PowerView AD Access Control List Enumeration - Rule", "ESCU - Windows Rapid Authentication On Multiple Hosts - Rule", "ESCU - Windows Special Privileged Logon On Multiple Hosts - Rule"]
+description = UPDATE_DESCRIPTION
+narrative = UPDATE_NARRATIVE
+
 [analytic_story://AgentTesla]
 category = Malware
 last_updated = 2022-04-12
@@ -12958,6 +13120,17 @@ searches = ["ESCU - Azure AD External Guest User Invited - Rule", "ESCU - Azure
 description = Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants.
 narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants. 
 
+[analytic_story://Azure Active Directory Privilege Escalation]
+category = 
+last_updated = 2023-03-20
+version = 1
+references = []
+maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
+spec_version = 3
+searches = []
+description = UPDATE_DESCRIPTION
+narrative = UPDATE_NARRATIVE
+
 [analytic_story://Baron Samedit CVE-2021-3156]
 category = Adversary Tactics
 last_updated = 2021-01-27
@@ -14367,7 +14540,7 @@ version = 1
 references = ["https://adsecurity.org/?p=1929", "https://www.youtube.com/watch?v=Lz6haohGAMc\u0026feature=youtu.be", "https://adsecurity.org/wp-content/uploads/2015/09/DEFCON23-2015-Metcalf-RedvsBlue-ADAttackAndDefense-Final.pdf", "https://attack.mitre.org/tactics/TA0003/", "https://www.dcshadow.com", "https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2", "https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer"]
 maintainers = [{"company": "Mauricio Velazco, Splunk", "email": "-", "name": "Dean Luxton"}]
 spec_version = 3
-searches = ["ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Windows AD AdminSDHolder ACL Modified - Rule", "ESCU - Windows AD Cross Domain SID History Addition - Rule", "ESCU - Windows AD Domain Controller Audit Policy Disabled - Rule", "ESCU - Windows AD Domain Controller Promotion - Rule", "ESCU - Windows AD Domain Replication ACL Addition - Rule", "ESCU - Windows AD DSRM Account Changes - Rule", "ESCU - Windows AD DSRM Password Reset - Rule", "ESCU - Windows AD Privileged Account SID History Addition - Rule", "ESCU - Windows AD Replication Request Initiated by User Account - Rule", "ESCU - Windows AD Replication Request Initiated from Unsanctioned Location - Rule", "ESCU - Windows AD Same Domain SID History Addition - Rule", "ESCU - Windows AD Short Lived Domain Account ServicePrincipalName - Rule", "ESCU - Windows AD Short Lived Domain Controller SPN Attribute - Rule", "ESCU - Windows AD Short Lived Server Object - Rule", "ESCU - Windows AD SID History Attribute Modified - Rule", "ESCU - Windows Security Support Provider Reg Query - Rule", "ESCU - Windows AD Replication Service Traffic - Rule", "ESCU - Windows AD Rogue Domain Controller Network Activity - Rule"]
+searches = ["ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Windows AD AdminSDHolder ACL Modified - Rule", "ESCU - Windows AD Cross Domain SID History Addition - Rule", "ESCU - Windows AD Domain Controller Audit Policy Disabled - Rule", "ESCU - Windows AD Domain Controller Promotion - Rule", "ESCU - Windows AD Domain Replication ACL Addition - Rule", "ESCU - Windows AD DSRM Account Changes - Rule", "ESCU - Windows AD DSRM Password Reset - Rule", "ESCU - Windows AD Privileged Account SID History Addition - Rule", "ESCU - Windows AD Replication Request Initiated by User Account - Rule", "ESCU - Windows AD Replication Request Initiated from Unsanctioned Location - Rule", "ESCU - Windows AD Same Domain SID History Addition - Rule", "ESCU - Windows AD Short Lived Domain Account ServicePrincipalName - Rule", "ESCU - Windows AD Short Lived Domain Controller SPN Attribute - Rule", "ESCU - Windows AD Short Lived Server Object - Rule", "ESCU - Windows AD SID History Attribute Modified - Rule", "ESCU - Windows Admon Default Group Policy Object Modified - Rule", "ESCU - Windows Admon Group Policy Object Created - Rule", "ESCU - Windows Default Group Policy Object Modified - Rule", "ESCU - Windows Default Group Policy Object Modified with GPME - Rule", "ESCU - Windows Group Policy Object Created - Rule", "ESCU - Windows Security Support Provider Reg Query - Rule", "ESCU - Windows AD Replication Service Traffic - Rule", "ESCU - Windows AD Rogue Domain Controller Network Activity - Rule"]
 description = Monitor for activities and techniques associated with Windows Active Directory persistence techniques.
 narrative = Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Active Directory is a centralized and hierarchical database that stores information about users, computers, and other resources on a network. It provides secure and efficient management of these resources and enables administrators to enforce security policies and delegate administrative tasks.\
 In 2015 Active Directory security researcher Sean Metcalf published a blog post titled `Sneaky Active Directory Persistence Tricks`. In this blog post, Sean described several methods through which an attacker could persist administrative access on an Active Directory network after having Domain Admin level rights for a short period of time. At the time of writing, 8 years after the initial blog post, most of these techniques are still possible since they abuse legitimate administrative functionality and not software vulnerabilities. Security engineers defending Active Directory networks should be aware of these technique available to adversaries post exploitation and deploy both preventive and detective security controls for them.\

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-20T19:56:47 UTC
+# On Date: 2023-04-24T21:58:20 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-20T19:56:47 UTC
+# On Date: 2023-04-24T21:58:20 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-20T19:56:47 UTC
+# On Date: 2023-04-24T21:58:20 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -3641,6 +3641,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_administrative_shares_accessed_on_multiple_hosts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_admon_default_group_policy_object_modified_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_admon_group_policy_object_created_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_apache_benchmark_binary_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3749,6 +3761,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_default_group_policy_object_modified_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_default_group_policy_object_modified_with_gpme_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_defender_exclusion_registry_entry_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3829,6 +3849,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_dnsadmins_new_member_added_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_dotnet_binary_in_non_standard_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3881,6 +3905,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_file_share_discovery_with_powerview_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_file_transfer_protocol_in_non_common_process_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3889,6 +3917,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_findstr_gpp_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_gather_victim_host_information_camera_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3905,6 +3937,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_group_policy_object_created_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_hidden_schedule_task_settings_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4033,6 +4069,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_large_number_of_computer_service_tickets_requested_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_lateral_tool_transfer_remcom_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4041,6 +4081,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_local_administrator_credential_stuffing_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_mail_protocol_in_non_common_process_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4253,6 +4297,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_powersploit_gpp_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_powerview_ad_access_control_list_enumeration_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_powerview_constrained_delegation_discovery_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4313,6 +4365,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_rapid_authentication_on_multiple_hosts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_rasautou_dll_execution_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4481,6 +4537,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_special_privileged_logon_on_multiple_hosts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_steal_authentication_certificates_certificate_issued_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4954,6 +5014,10 @@ definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
 
+[admon]
+definition = source=ActiveDirectory
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [audit_searches]
 definition = index=_audit sourcetype=audittrail action=search
 description = Macro to enable easy searching of audittrail logs for searches

dist/escu/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-20T19:56:47 UTC
+# On Date: 2023-04-24T21:58:20 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -22863,7 +22863,7 @@ action.escu.full_search_name = ESCU - Kerberos Service Ticket Request Using RC4
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
+action.escu.analytic_story = ["Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = A Kerberos Service TTicket request with RC4 encryption was requested from $Client_Address$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}]
@@ -22874,7 +22874,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Kerberos Service Ticket Request Using RC4 Encryption - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "cis20": ["CIS 10"], "confidence": 50, "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.001"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 50, "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.001"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -32762,7 +32762,7 @@ action.escu.full_search_name = ESCU - Rubeus Command Line Parameters - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
+action.escu.analytic_story = ["Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = Rubeus command line parameters were used on $dest$
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"risk_object_field": "parent_process_name", "risk_object_type": "other", "risk_score": 36}]
@@ -32773,7 +32773,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Rubeus Command Line Parameters - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "cis20": ["CIS 10"], "confidence": 60, "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550", "T1550.003", "T1558", "T1558.003", "T1558.004"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 60, "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550", "T1550.003", "T1558", "T1558.003", "T1558.004"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -34243,7 +34243,7 @@ action.escu.full_search_name = ESCU - ServicePrincipalNames Discovery with Power
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["Active Directory Discovery", "Active Directory Kerberos Attacks", "Malicious PowerShell"]
+action.escu.analytic_story = ["Active Directory Discovery", "Active Directory Kerberos Attacks", "Malicious PowerShell", "Active Directory Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $Computer$ by user $UserID$ attempting to identify service principle names.
 action.risk.param._risk = [{"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "parent_process_name", "risk_object_type": "other", "risk_score": 80}, {"risk_object_field": "process_name", "risk_object_type": "other", "risk_score": 80}]
@@ -34254,7 +34254,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - ServicePrincipalNames Discovery with PowerShell - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Active Directory Kerberos Attacks", "Malicious PowerShell"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Active Directory Kerberos Attacks", "Malicious PowerShell", "Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -34307,7 +34307,7 @@ action.escu.full_search_name = ESCU - ServicePrincipalNames Discovery with SetSP
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Active Directory Discovery", "Active Directory Kerberos Attacks"]
+action.escu.analytic_story = ["Active Directory Discovery", "Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "parent_process_name", "risk_object_type": "other", "risk_score": 80}, {"risk_object_field": "process_name", "risk_object_type": "other", "risk_score": 80}]
@@ -34318,7 +34318,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - ServicePrincipalNames Discovery with SetSPN - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Active Directory Kerberos Attacks"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -35228,7 +35228,7 @@ action.escu.full_search_name = ESCU - Suspicious Computer Account Name Change -
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["sAMAccountName Spoofing and Domain Controller Impersonation"]
+action.escu.analytic_story = ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = A computer account $Old_Account_Name$ was renamed with a suspicious computer name
 action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 70}]
@@ -35239,7 +35239,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Suspicious Computer Account Name Change - Rule
-action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2021-42287", "CVE-2021-42278"], "impact": 100, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2021-42287", "CVE-2021-42278"], "impact": 100, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -35642,7 +35642,7 @@ action.escu.full_search_name = ESCU - Suspicious Kerberos Service Ticket Request
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks"]
+action.escu.analytic_story = ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious Kerberos Service Ticket was requested by $Account_Name$
 action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 60}]
@@ -35653,7 +35653,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Suspicious Kerberos Service Ticket Request - Rule
-action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks"], "cis20": ["CIS 10"], "confidence": 60, "cve": ["CVE-2021-42287", "CVE-2021-42278"], "impact": 100, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 60, "cve": ["CVE-2021-42287", "CVE-2021-42278"], "impact": 100, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -36705,13 +36705,13 @@ action.escu.full_search_name = ESCU - Suspicious Ticket Granting Ticket Request
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks"]
+action.escu.analytic_story = ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"]
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Suspicious Ticket Granting Ticket Request - Rule
-action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks"], "cis20": ["CIS 10"], "confidence": 60, "impact": 100, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["DE.AE"]}
+action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 60, "impact": 100, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["DE.AE"]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -37495,13 +37495,13 @@ action.escu.full_search_name = ESCU - Unusual Number of Computer Service Tickets
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["Active Directory Lateral Movement", "Active Directory Kerberos Attacks"]
+action.escu.analytic_story = ["Active Directory Lateral Movement", "Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"]
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Unusual Number of Computer Service Tickets Requested - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Active Directory Kerberos Attacks"], "cis20": ["CIS 10"], "confidence": 60, "impact": 70, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078"], "nist": ["DE.AE"]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Active Directory Kerberos Attacks", "Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 60, "impact": 70, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078"], "nist": ["DE.AE"]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -37565,7 +37565,7 @@ action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation
 action.escu.data_models = []
 action.escu.eli5 = The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, to identify an unusual number of remote authentication attempts coming from one source. An endpoint authenticating to a large number of remote endpoints could represent malicious behavior like lateral movement, malware staging, reconnaissance, etc.\
 The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual high number of authentication events. To customize this analytic, users can try different combinations of the `bucket` span time,  the calculation of the `upperBound` field as well as the Outlier calculation. This logic can be used for real time security monitoring as well as threat hunting exercises.\
-action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
 action.escu.known_false_positives = An single endpoint authenticating to a large number of hosts is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, jump servers and missconfigured systems.
 action.escu.creation_date = 2021-12-01
 action.escu.modification_date = 2021-12-01
@@ -37574,13 +37574,13 @@ action.escu.full_search_name = ESCU - Unusual Number of Remote Endpoint Authenti
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["Active Directory Lateral Movement"]
+action.escu.analytic_story = ["Active Directory Lateral Movement", "Active Directory Privilege Escalation"]
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "cis20": ["CIS 10"], "confidence": 60, "impact": 70, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078"], "nist": ["DE.AE"]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 60, "impact": 70, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078"], "nist": ["DE.AE"]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -39089,6 +39089,144 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="* -gcb *" OR Processes.process="* -sc *") by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter`
 
+[ESCU - Windows Administrative Shares Accessed On Multiple Hosts - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages Event IDs 5140 or 5145 to identify a source computer accessing windows administrative shares (C$, Admin$ and IPC$ ) across a large number remote endpoints. Specifically, the logic will trigger when a source endpoint accesses administrative shares across 30 or more target computers within a 5 minute timespan. This behavior could represent an adversary who is enumerating network shares across an Active Directory environment in the search for sensitive files, a common technique leveraged by red teamers and threat actors. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1135"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages Event IDs 5140 or 5145 to identify a source computer accessing windows administrative shares (C$, Admin$ and IPC$ ) across a large number remote endpoints. Specifically, the logic will trigger when a source endpoint accesses administrative shares across 30 or more target computers within a 5 minute timespan. This behavior could represent an adversary who is enumerating network shares across an Active Directory environment in the search for sensitive files, a common technique leveraged by red teamers and threat actors. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting file share events. The Advanced Security Audit policy setting `Audit Detailed File Share` or `Audit File Share` within `Object Access` need to be enabled.
+action.escu.known_false_positives = An single endpoint accessing windows administrative shares across a large number of endpoints is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
+action.escu.creation_date = 2023-03-23
+action.escu.modification_date = 2023-03-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Administrative Shares Accessed On Multiple Hosts - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation", "Active Directory Lateral Movement"]
+action.risk = 1
+action.risk.param._risk_message = $IpAddress$ accessed the IPC share on more than 40 endpoints in a timespan of 5 minutes.
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "IpAddress", "risk_object_type": "system", "risk_score": 56}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Administrative Shares Accessed On Multiple Hosts - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation", "Active Directory Lateral Movement"], "cis20": ["CIS 10"], "confidence": 80, "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1135"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages Event IDs 5140 or 5145 to identify a source computer accessing windows administrative shares (C$, Admin$ and IPC$ ) across a large number remote endpoints. Specifically, the logic will trigger when a source endpoint accesses administrative shares across 30 or more target computers within a 5 minute timespan. This behavior could represent an adversary who is enumerating network shares across an Active Directory environment in the search for sensitive files, a common technique leveraged by red teamers and threat actors. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.notable.param.rule_title = Windows Administrative Shares Accessed On Multiple Hosts
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `wineventlog_security` EventCode=5140 OR EventCode=5145 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$") | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(ShareName) as shares by _time, IpAddress, SubjectUserName, EventCode | where unique_targets > 30 | `windows_administrative_shares_accessed_on_multiple_hosts_filter`
+
+[ESCU - Windows Admon Default Group Policy Object Modified - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages Splunks Admon to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages Splunks Admon to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs.
+action.escu.how_to_implement = To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory
+action.escu.known_false_positives = The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
+action.escu.creation_date = 2023-03-29
+action.escu.modification_date = 2023-03-29
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Admon Default Group Policy Object Modified - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Active Directory Privilege Escalation", "Sneaky Active Directory Persistence Tricks"]
+action.risk = 1
+action.risk.param._risk_message = A default domain group policy was updated on $dcName$
+action.risk.param._risk = [{"risk_object_field": "dcName", "risk_object_type": "system", "risk_score": 50}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Admon Default Group Policy Object Modified - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation", "Sneaky Active Directory Persistence Tricks"], "cis20": ["CIS 10"], "confidence": 50, "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages Splunks Admon to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs.
+action.notable.param.rule_title = Windows Admon Default Group Policy Object Modified
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy") | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admon_default_group_policy_object_modified_filter`
+
+[ESCU - Windows Admon Group Policy Object Created - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages Splunks Admon to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network. Security teams should monitor the creation of new Group Policy Objects.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages Splunks Admon to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network. Security teams should monitor the creation of new Group Policy Objects.
+action.escu.how_to_implement = To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory
+action.escu.known_false_positives = Group Policy Objects are created as part of regular administrative operations, filter as needed.
+action.escu.creation_date = 2023-04-06
+action.escu.modification_date = 2023-04-06
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Admon Group Policy Object Created - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Active Directory Privilege Escalation", "Sneaky Active Directory Persistence Tricks"]
+action.risk = 1
+action.risk.param._risk_message = A new group policy objected was created on $dcName$
+action.risk.param._risk = [{"risk_object_field": "dcName", "risk_object_type": "system", "risk_score": 50}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Admon Group Policy Object Created - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation", "Sneaky Active Directory Persistence Tricks"], "cis20": ["CIS 10"], "confidence": 50, "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages Splunks Admon to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network. Security teams should monitor the creation of new Group Policy Objects.
+action.notable.param.rule_title = Windows Admon Group Policy Object Created
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber=0 displayName!="New Group Policy Object" | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admon_group_policy_object_created_filter`
+
 [ESCU - Windows Apache Benchmark Binary - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -40267,6 +40405,98 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_path !="*\\Windows\\Explorer.EXE" by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid  Processes.original_file_name | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] | `windows_defacement_modify_transcodedwallpaper_file_filter`
 
+[ESCU - Windows Default Group Policy Object Modified - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages Event ID 5136 to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages Event ID 5136 to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs.
+action.escu.how_to_implement = To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled. Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default. A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/.
+action.escu.known_false_positives = The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
+action.escu.creation_date = 2023-03-28
+action.escu.modification_date = 2023-03-28
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Default Group Policy Object Modified - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation", "Sneaky Active Directory Persistence Tricks"]
+action.risk = 1
+action.risk.param._risk_message = A default group policy object was modified on $Computer$ by $SubjectUserSid$
+action.risk.param._risk = [{"risk_object_field": "SubjectUserSid", "risk_object_type": "user", "risk_score": 50}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 50}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Default Group Policy Object Modified - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation", "Sneaky Active Directory Persistence Tricks"], "cis20": ["CIS 10"], "confidence": 50, "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages Event ID 5136 to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs.
+action.notable.param.rule_title = Windows Default Group Policy Object Modified
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=versionNumber (ObjectDN="CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=*" OR ObjectDN="CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=POLICIES,CN=SYSTEM,DC=*") | stats min(_time) as firstTime max(_time) as lastTime by ObjectDN SubjectUserSid AttributeValue Computer DSName | rename AttributeValue as versionNumber | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_group_policy_object_modified_filter`
+
+[ESCU - Windows Default Group Policy Object Modified with GPME - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages the Endpoint datamodel to identify the potential edition of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic leverages the Endpoint datamodel to identify the potential edition of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
+action.escu.creation_date = 2023-04-24
+action.escu.modification_date = 2023-04-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Default Group Policy Object Modified with GPME - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation", "Sneaky Active Directory Persistence Tricks"]
+action.risk = 1
+action.risk.param._risk_message = A default group policy object was opened with Group Policy Manage Editor on $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 50}, {"risk_object_field": "parent_process_name", "risk_object_type": "other", "risk_score": 50}, {"risk_object_field": "process_name", "risk_object_type": "other", "risk_score": 50}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Default Group Policy Object Modified with GPME - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation", "Sneaky Active Directory Persistence Tricks"], "cis20": ["CIS 10"], "confidence": 50, "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484", "T1484.001"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages the Endpoint datamodel to identify the potential edition of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs.
+action.notable.param.rule_title = Windows Default Group Policy Object Modified with GPME
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mmc.exe (Processes.process =*gpme.msc*) AND (Processes.process = "*31B2F340-016D-11D2-945F-00C04FB984F9*" OR Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*"  ) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_group_policy_object_modified_with_gpme_filter`
+
 [ESCU - Windows Defender Exclusion Registry Entry - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -41100,6 +41330,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "dnscmd.exe" Processes.process = "* /enumrecords *" by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dns_gather_network_info_filter`
 
+[ESCU - Windows DnsAdmins New Member Added - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages Event ID 4732 to identify the addition of a new member to the DnsAdmins group within Active Directory. . Members of the DnsAdmin group can manage the DNS service which most of the times runs on the Domain Controller. By abusing legitimate DNS management functionality, a member of the DnsAdmins group can escalate privileges by executing malicious code on a Domain Controller as SYSTEM. Security teams should monitor the modification of the DnsAdmins group and validate the changes are legitimate.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages Event ID 4732 to identify the addition of a new member to the DnsAdmins group within Active Directory. . Members of the DnsAdmin group can manage the DNS service which most of the times runs on the Domain Controller. By abusing legitimate DNS management functionality, a member of the DnsAdmins group can escalate privileges by executing malicious code on a Domain Controller as SYSTEM. Security teams should monitor the modification of the DnsAdmins group and validate the changes are legitimate.
+action.escu.how_to_implement = To successfully implement this search, Domain Controller events need to be ingested. The Advanced Security Audit policy setting `Audit Security Group Management` within `Account Management` needs to be enabled.
+action.escu.known_false_positives = New members can be added to the DnsAdmins group as part of legitimate administrative tasks. Filter as needed.
+action.escu.creation_date = 2023-04-06
+action.escu.modification_date = 2023-04-06
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows DnsAdmins New Member Added - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation"]
+action.risk = 1
+action.risk.param._risk_message = A new member was added to the DnsAdmins group by $SubjectUserName$
+action.risk.param._risk = [{"risk_object_field": "SubjectUserName", "risk_object_type": "user", "risk_score": 40}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows DnsAdmins New Member Added - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 50, "impact": 80, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages Event ID 4732 to identify the addition of a new member to the DnsAdmins group within Active Directory. . Members of the DnsAdmin group can manage the DNS service which most of the times runs on the Domain Controller. By abusing legitimate DNS management functionality, a member of the DnsAdmins group can escalate privileges by executing malicious code on a Domain Controller as SYSTEM. Security teams should monitor the modification of the DnsAdmins group and validate the changes are legitimate.
+action.notable.param.rule_title = Windows DnsAdmins New Member Added
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `wineventlog_security` EventCode=4732 TargetUserName=DnsAdmins | stats min(_time) as firstTime max(_time) as lastTime values(SubjectUserName) values(Computer) by MemberSid, TargetUserName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dnsadmins_new_member_added_filter`
+
 [ESCU - Windows DotNet Binary in Non Standard Path - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -41642,6 +41918,52 @@ realtime_schedule = 0
 is_visible = false
 search = `certificateservices_lifecycle` EventCode=1007 | xmlkv UserData_Xml | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SubjectName, UserData_Xml | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_export_certificate_filter`
 
+[ESCU - Windows File Share Discovery With Powerview - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the use of the Invoke-ShareFinder PowerShell commandlet part of PowerView. This module obtains the list of all active domain computers and lists the active shares on each computer. Network file shares in Active Directory environments may contain sensitive information like backups, scripts, credentials, etc. Adversaries who have obtained a foothold in an AD network may leverage PowerView to identify secrets and leverage them for Privilege Escalation or Lateral Movement.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1135"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the use of the Invoke-ShareFinder PowerShell commandlet part of PowerView. This module obtains the list of all active domain computers and lists the active shares on each computer. Network file shares in Active Directory environments may contain sensitive information like backups, scripts, credentials, etc. Adversaries who have obtained a foothold in an AD network may leverage PowerView to identify secrets and leverage them for Privilege Escalation or Lateral Movement.
+action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.=
+action.escu.known_false_positives = Security teams may leverage PowerView proactively to identify and remediate sensitive file shares. Filter as needed.
+action.escu.creation_date = 2023-03-20
+action.escu.modification_date = 2023-03-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows File Share Discovery With Powerview - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation", "Active Directory Discovery"]
+action.risk = 1
+action.risk.param._risk_message = Invoke-ShareFinder commandlet was executed on $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 48}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows File Share Discovery With Powerview - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation", "Active Directory Discovery"], "cis20": ["CIS 10"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1135"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the use of the Invoke-ShareFinder PowerShell commandlet part of PowerView. This module obtains the list of all active domain computers and lists the active shares on each computer. Network file shares in Active Directory environments may contain sensitive information like backups, scripts, credentials, etc. Adversaries who have obtained a foothold in an AD network may leverage PowerView to identify secrets and leverage them for Privilege Escalation or Lateral Movement.
+action.notable.param.rule_title = Windows File Share Discovery With Powerview
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `powershell` EventCode=4104  (ScriptBlockText=Invoke-ShareFinder*) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_share_discovery_with_powerview_filter`
+
 [ESCU - Windows File Transfer Protocol In Non-Common Process Path - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -41728,6 +42050,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*") by _time span=5m Filesystem.dest Filesystem.user Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.file_create_time | `drop_dm_object_name(Filesystem)` | rex field="file_name" "\.(?<extension>[^\.]*$)" | where isnull(extension) | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=5m Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)`] | stats count min(_time) as firstTime max(_time) as lastTime by dest process_name process_guid file_name file_path file_create_time user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_without_extension_in_critical_folder_filter`
 
+[ESCU - Windows Findstr GPP Discovery - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the use of the findstr command employed to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552", "T1552.006"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies the use of the findstr command employed to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = Administrators may leverage findstr to find passwords in GPO to validate exposure. Filter as needed.
+action.escu.creation_date = 2023-03-16
+action.escu.modification_date = 2023-03-16
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Findstr GPP Discovery - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation"]
+action.risk = 1
+action.risk.param._risk_message = Findstr was executed to discover GPP credentials on $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Findstr GPP Discovery - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 80, "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552", "T1552.006"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the use of the findstr command employed to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
+action.notable.param.rule_title = Windows Findstr GPP Discovery
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=findstr.exe AND Processes.process=*sysvol* AND Processes.process=*cpassword*) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_findstr_gpp_discovery_filter`
+
 [ESCU - Windows Gather Victim Host Information Camera - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -41884,6 +42252,52 @@ realtime_schedule = 0
 is_visible = false
 search =  `powershell` EventCode=4104 (Message = "*Get-ADComputer*" AND Message = "*TrustedForDelegation*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_get_adcomputer_unconstrained_delegation_discovery_filter`
 
+[ESCU - Windows Group Policy Object Created - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages Event IDs 5136 and 51137 to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network. Security teams should monitor the creation of new Group Policy Objects.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1484", "T1484.001", "T1078.002"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages Event IDs 5136 and 51137 to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network. Security teams should monitor the creation of new Group Policy Objects.
+action.escu.how_to_implement = To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled. Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default. A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/.
+action.escu.known_false_positives = Group Policy Objects are created as part of regular administrative operations, filter as needed.
+action.escu.creation_date = 2023-03-27
+action.escu.modification_date = 2023-03-27
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Group Policy Object Created - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation", "Sneaky Active Directory Persistence Tricks"]
+action.risk = 1
+action.risk.param._risk_message = A new group policy objected was created by $User$
+action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Group Policy Object Created - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation", "Sneaky Active Directory Persistence Tricks"], "cis20": ["CIS 10"], "confidence": 50, "impact": 80, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1484", "T1484.001", "T1078.002"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages Event IDs 5136 and 51137 to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network. Security teams should monitor the creation of new Group Policy Objects.
+action.notable.param.rule_title = Windows Group Policy Object Created
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `wineventlog_security` EventCode=5137 OR (EventCode=5136 AttributeValue!="New Group Policy Object" AND (AttributeLDAPDisplayName=displayName OR AttributeLDAPDisplayName=gPCFileSysPath) ) ObjectClass=groupPolicyContainer | stats values(AttributeValue) as details values(SubjectUserSid) as User values(ObjectDN) as ObjectDN by ObjectGUID Computer | eval GPO_Name = mvindex(details, 0) | eval GPO_Path = mvindex(details, 1) | fields - details | `windows_group_policy_object_created_filter`
+
 [ESCU - Windows Hidden Schedule Task Settings - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -43265,6 +43679,48 @@ realtime_schedule = 0
 is_visible = false
 search = `wineventlog_system` EventCode=7045 Service_Name IN ("KrbSCM") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_krbrelayup_service_creation_filter`
 
+[ESCU - Windows Large Number of Computer Service Tickets Requested - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, to identify more than 30 computer service ticket requests from one source. When a domain joined endpoint connects to other remote endpoint, it will first request a Kerberos Service Ticket with the computer name as the Service Name. A user requesting a large number of computer service tickets for different endpoints could represent malicious behavior like lateral movement, malware staging, reconnaissance, etc.\
+Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold as needed.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1135", "T1078"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, to identify more than 30 computer service ticket requests from one source. When a domain joined endpoint connects to other remote endpoint, it will first request a Kerberos Service Ticket with the computer name as the Service Name. A user requesting a large number of computer service tickets for different endpoints could represent malicious behavior like lateral movement, malware staging, reconnaissance, etc.\
+Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold as needed.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+action.escu.known_false_positives = An single endpoint requesting a large number of kerberos service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
+action.escu.creation_date = 2023-03-20
+action.escu.modification_date = 2023-03-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Large Number of Computer Service Tickets Requested - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation", "Active Directory Lateral Movement"]
+action.risk = 1
+action.risk.param._risk_message = A large number of kerberos computer service tickets were requested by $IpAddress$ within 5 minutes.
+action.risk.param._risk = [{"risk_object_field": "IpAddress", "risk_object_type": "system", "risk_score": 30}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Large Number of Computer Service Tickets Requested - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation", "Active Directory Lateral Movement"], "cis20": ["CIS 10"], "confidence": 50, "impact": 60, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1135", "T1078"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$" | bucket span=5m _time | stats dc(ServiceName) AS unique_targets values(ServiceName) as host_targets by _time, IpAddress, TargetUserName | where unique_targets > 30 | `windows_large_number_of_computer_service_tickets_requested_filter`
+
 [ESCU - Windows Lateral Tool Transfer RemCom - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -43351,6 +43807,52 @@ realtime_schedule = 0
 is_visible = false
 search = `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_linked_policies_in_adsi_discovery_filter`
 
+[ESCU - Windows Local Administrator Credential Stuffing - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages events 4625 and 4624 to identify an endpoint using the builtin local Administrator account to authenticate to a large numbers of endpoints. Specifically, the logic will trigger when an endpoints attempts to authenticate to more than 30 target computers within a 5 minute timespan. This behavior could represent an adversary who has obtained access to local credentials and is trying to validate if these credentials work on other hosts to escalate their privileges. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110", "T1110.004"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages events 4625 and 4624 to identify an endpoint using the builtin local Administrator account to authenticate to a large numbers of endpoints. Specifically, the logic will trigger when an endpoints attempts to authenticate to more than 30 target computers within a 5 minute timespan. This behavior could represent an adversary who has obtained access to local credentials and is trying to validate if these credentials work on other hosts to escalate their privileges. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
+action.escu.known_false_positives = Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed.
+action.escu.creation_date = 2023-03-22
+action.escu.modification_date = 2023-03-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Local Administrator Credential Stuffing - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation", "Active Directory Lateral Movement"]
+action.risk = 1
+action.risk.param._risk_message = Local Administrator credential stuffing attack coming from $IpAddress$
+action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "IpAddress", "risk_object_type": "system", "risk_score": 56}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Local Administrator Credential Stuffing - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation", "Active Directory Lateral Movement"], "cis20": ["CIS 10"], "confidence": 80, "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110", "T1110.004"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages events 4625 and 4624 to identify an endpoint using the builtin local Administrator account to authenticate to a large numbers of endpoints. Specifically, the logic will trigger when an endpoints attempts to authenticate to more than 30 target computers within a 5 minute timespan. This behavior could represent an adversary who has obtained access to local credentials and is trying to validate if these credentials work on other hosts to escalate their privileges. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.notable.param.rule_title = Windows Local Administrator Credential Stuffing
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `wineventlog_security` EventCode=4625 OR EventCode=4624 Logon_Type=3 TargetUserName=Administrator | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName, EventCode | where unique_targets > 30 | `windows_local_administrator_credential_stuffing_filter`
+
 [ESCU - Windows Mail Protocol In Non-Common Process Path - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -45686,6 +46188,98 @@ realtime_schedule = 0
 is_visible = false
 search = `powershell` EventCode=4104 ScriptBlockText="*win32_scheduledjob*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_wmi_win32_scheduledjob_filter`
 
+[ESCU - Windows PowerSploit GPP Discovery - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the use of the Get-GPPPassword PowerShell commandlet employed to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552", "T1552.006"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the use of the Get-GPPPassword PowerShell commandlet employed to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
+action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+action.escu.known_false_positives = Unknown
+action.escu.creation_date = 2023-03-16
+action.escu.modification_date = 2023-03-16
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows PowerSploit GPP Discovery - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation"]
+action.risk = 1
+action.risk.param._risk_message = Commandlets leveraged to discover GPP credentials were executed on $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows PowerSploit GPP Discovery - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 80, "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552", "T1552.006"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the use of the Get-GPPPassword PowerShell commandlet employed to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
+action.notable.param.rule_title = Windows PowerSploit GPP Discovery
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `powershell` EventCode=4104  (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powersploit_gpp_discovery_filter`
+
+[ESCU - Windows PowerView AD Access Control List Enumeration - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages Event ID 4104 to identify the execution of the PowerView powershell commandlets `Get-ObjectAcl` or `Get-DomainObjectAcl`. This commandlets are used to enumerate Access Control List permissions given to Active Directory objects. In an active directory environment, an object is an entity that represents an available resource within the organizations network, such as domain controllers, users, groups, computers, shares, etc.  Maintaining Active Directory permissions is complicated and hard to manage, especially in complex and large environments with multiple domains. Weak permissions may allow adversaries and red teamers to escalate their privileges in Active Directory. PowerView is a common tool leveraged by attackers to identify and exploit configuration weaknesses.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078.002", "T1069"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages Event ID 4104 to identify the execution of the PowerView powershell commandlets `Get-ObjectAcl` or `Get-DomainObjectAcl`. This commandlets are used to enumerate Access Control List permissions given to Active Directory objects. In an active directory environment, an object is an entity that represents an available resource within the organizations network, such as domain controllers, users, groups, computers, shares, etc.  Maintaining Active Directory permissions is complicated and hard to manage, especially in complex and large environments with multiple domains. Weak permissions may allow adversaries and red teamers to escalate their privileges in Active Directory. PowerView is a common tool leveraged by attackers to identify and exploit configuration weaknesses.
+action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.=
+action.escu.known_false_positives = Administrators may leverage PowerView for legitimate purposes, filter as needed.
+action.escu.creation_date = 2023-04-20
+action.escu.modification_date = 2023-04-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows PowerView AD Access Control List Enumeration - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Discovery", "Active Directory Privilege Escalation"]
+action.risk = 1
+action.risk.param._risk_message = PowerView AD acccess control list enumeration detected on $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 20}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows PowerView AD Access Control List Enumeration - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Active Directory Privilege Escalation"], "cis20": ["CIS 10"], "confidence": 50, "impact": 40, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078.002", "T1069"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages Event ID 4104 to identify the execution of the PowerView powershell commandlets `Get-ObjectAcl` or `Get-DomainObjectAcl`. This commandlets are used to enumerate Access Control List permissions given to Active Directory objects. In an active directory environment, an object is an entity that represents an available resource within the organizations network, such as domain controllers, users, groups, computers, shares, etc.  Maintaining Active Directory permissions is complicated and hard to manage, especially in complex and large environments with multiple domains. Weak permissions may allow adversaries and red teamers to escalate their privileges in Active Directory. PowerView is a common tool leveraged by attackers to identify and exploit configuration weaknesses.
+action.notable.param.rule_title = Windows PowerView AD Access Control List Enumeration
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `powershell` EventCode=4104  (ScriptBlockText=*get-objectacl* OR ScriptBlockText=*Get-DomainObjectAcl* ) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_ad_access_control_list_enumeration_filter`
+
 [ESCU - Windows PowerView Constrained Delegation Discovery - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -46324,6 +46918,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`
 
+[ESCU - Windows Rapid Authentication On Multiple Hosts - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages Event ID 4624 to identify a source computer authenticating to a large number of remote endpoints within an Active Directory network. Specifically, the logic will trigger when a source endpoint authenticates to 30 or more target computers within a 5 minute timespan. This behavior could represent an adversary who is moving laterally across the environment or enumerating network shares in the search for sensitive files. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages Event ID 4624 to identify a source computer authenticating to a large number of remote endpoints within an Active Directory network. Specifically, the logic will trigger when a source endpoint authenticates to 30 or more target computers within a 5 minute timespan. This behavior could represent an adversary who is moving laterally across the environment or enumerating network shares in the search for sensitive files. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
+action.escu.known_false_positives = Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed.
+action.escu.creation_date = 2023-03-23
+action.escu.modification_date = 2023-03-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Rapid Authentication On Multiple Hosts - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation", "Active Directory Lateral Movement"]
+action.risk = 1
+action.risk.param._risk_message = The source computer with ip address $IpAddress$ authenticated to a large number of remote endpoints within 5 minutes.
+action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "IpAddress", "risk_object_type": "system", "risk_score": 48}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Rapid Authentication On Multiple Hosts - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation", "Active Directory Lateral Movement"], "cis20": ["CIS 10"], "confidence": 80, "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages Event ID 4624 to identify a source computer authenticating to a large number of remote endpoints within an Active Directory network. Specifically, the logic will trigger when a source endpoint authenticates to 30 or more target computers within a 5 minute timespan. This behavior could represent an adversary who is moving laterally across the environment or enumerating network shares in the search for sensitive files. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.notable.param.rule_title = Windows Rapid Authentication On Multiple Hosts
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =   `wineventlog_security` EventCode=4624 LogonType=3 TargetUserName!="ANONYMOUS LOGON" TargetUserName!="*$" | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName | where unique_targets > 30 | `windows_rapid_authentication_on_multiple_hosts_filter`
+
 [ESCU - Windows Rasautou DLL Execution - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -48157,6 +48797,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("onenote.exe", "onenotem.exe") `process_mshta` by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_spearphishing_attachment_onenote_spawn_mshta_filter`
 
+[ESCU - Windows Special Privileged Logon On Multiple Hosts - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages Event ID 4672 to identify a source user authenticating with special privileges across a large number remote endpoints. Specifically, the logic will trigger when a source user obtains special privileges across 30 or more target computers within a 5 minute timespan. Special privileges are assigned to a new logon session when sensitive privileges like SeDebugPrivilege and SeImpersonatePrivilege are assigned. This behavior could represent an adversary who is moving laterally and executing remote code across the network. It can also be triggered by other behavior like an adversary enumerating network shares. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087", "T1021.002", "T1135"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages Event ID 4672 to identify a source user authenticating with special privileges across a large number remote endpoints. Specifically, the logic will trigger when a source user obtains special privileges across 30 or more target computers within a 5 minute timespan. Special privileges are assigned to a new logon session when sensitive privileges like SeDebugPrivilege and SeImpersonatePrivilege are assigned. This behavior could represent an adversary who is moving laterally and executing remote code across the network. It can also be triggered by other behavior like an adversary enumerating network shares. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting special logon events. The Advanced Security Audit policy setting `Audit Special Logon` within `Logon/Logoff` need to be enabled.
+action.escu.known_false_positives = Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed.
+action.escu.creation_date = 2023-03-27
+action.escu.modification_date = 2023-03-27
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Special Privileged Logon On Multiple Hosts - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Privilege Escalation", "Active Directory Lateral Movement"]
+action.risk = 1
+action.risk.param._risk_message = A source user $Caller_User_Name$ obtained special privileges on a large number of endpoints within 5 minutes.
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "Caller_User_Name", "risk_object_type": "user", "risk_score": 64}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Special Privileged Logon On Multiple Hosts - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Privilege Escalation", "Active Directory Lateral Movement"], "cis20": ["CIS 10"], "confidence": 80, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087", "T1021.002", "T1135"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages Event ID 4672 to identify a source user authenticating with special privileges across a large number remote endpoints. Specifically, the logic will trigger when a source user obtains special privileges across 30 or more target computers within a 5 minute timespan. Special privileges are assigned to a new logon session when sensitive privileges like SeDebugPrivilege and SeImpersonatePrivilege are assigned. This behavior could represent an adversary who is moving laterally and executing remote code across the network. It can also be triggered by other behavior like an adversary enumerating network shares. As environments differ across organizations, security teams should customize the thresholds of this detection as needed.
+action.notable.param.rule_title = Windows Special Privileged Logon On Multiple Hosts
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `wineventlog_security` EventCode=4672 AND NOT(Caller_User_Name IN ("DWM-1","DWM-2","DWM-3","LOCAL SERVICE","NETWORK SERVICE","SYSTEM","*$")) | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(PrivilegeList) as privileges by _time, Caller_User_Name | where unique_targets > 30 | `windows_special_privileged_logon_on_multiple_hosts_filter`
+
 [ESCU - Windows Steal Authentication Certificates Certificate Issued - Rule]
 action.escu = 0
 action.escu.enabled = 1

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-20T19:56:47 UTC
+# On Date: 2023-04-24T21:58:20 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-20T19:56:47 UTC
+# On Date: 2023-04-24T21:58:20 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

macros/admon.yml

@@ -0,0 +1,4 @@
+definition: source=ActiveDirectory
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: admon

stories/active_directory_privilege_escalation.yml

@@ -0,0 +1,30 @@
+name: Active Directory Privilege Escalation
+id: fa34a5d8-df0a-404c-8237-11f99cba1d5f
+version: 1
+date: '2023-03-20'
+author: Mauricio Velazco, Splunk
+description: Monitor for activities and techniques associated with Privilege Escalation
+  attacks within Active Directory environments.
+narrative: Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. 
+  Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. 
+  Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities.\
+
+  Active Directory is a central component of most enterprise networks, providing authentication and authorization services for users, computers, and other resources.
+  It stores sensitive information such as passwords, user accounts, and security policies, and is therefore a high-value target for attackers.
+  Privilege escalation attacks in Active Directory typically involve exploiting vulnerabilities or misconfigurations across the network to gain elevated privileges,
+  such as Domain Administrator access. Once an attacker has escalated their privileges and taken full control of a domain, they can easily move laterally throughout the network, 
+  access sensitive data, and carry out further attacks. Security teams should monitor for privilege escalation attacks in Active Directory to identify a breach before attackers achieve operational success.\
+   
+  The following analytic story groups detection opportunities that seek to identify an adversary attempting to escalate privileges in an Active Directory network.
+references:
+- https://attack.mitre.org/tactics/TA0004/
+- https://adsecurity.org/?p=3658
+- https://adsecurity.org/?p=2362
+tags:
+  analytic_story: Active Directory Privilege Escalation
+  category: []
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection