From 436eeb8b96462e7fb216623a44e1dc3883158c45 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 30 Mar 2022 10:11:10 -0600
Subject: [PATCH 01/18] ISO

---
 .../windows_iso_lnk_file_creation.yml         | 63 +++++++++++++++++++
 .../windows_iso_lnk_file_creation.test.yml    | 12 ++++
 2 files changed, 75 insertions(+)
 create mode 100644 detections/endpoint/windows_iso_lnk_file_creation.yml
 create mode 100644 tests/endpoint/windows_iso_lnk_file_creation.test.yml

diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml
new file mode 100644
index 0000000000..6c9a0d438a
--- /dev/null
+++ b/detections/endpoint/windows_iso_lnk_file_creation.yml
@@ -0,0 +1,63 @@
+name: 'Windows ISO LNK File Creation'
+id: d7c2c09b-9569-4a9e-a8b6-6a39a99c1d32
+version: 1
+date: '2022-03-29'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of a delivered ISO file that has been mounted and the afformention lnk or file opened within it. When the ISO file is opened, the files are saved in the %USER%\AppData\Local\Temp\<random folder name>\ path. 
+  The analytic identifies .iso.lnk written to the path. The name of the ISO file is prepended. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Microsoft\\Windows\\Recent\\*") Filesystem.file_name IN ("*.iso.lnk") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest 
+  | `drop_dm_object_name(Filesystem)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_iso_lnk_file_creation_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be high depending on the environment and consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.
+references:
+- https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
+- https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  context:
+  - Source:Endpoint
+  - Stage:Delivery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon.log
+  kill_chain_phases:
+  - Delivery
+  message: An ISO file was mounted on $dest$ and should be reviewed and filtered as needed.
+  mitre_attack_id:
+  - T1566.001
+  - T1566
+  - T1204.001
+  - T1204
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Filesystem.file_create_time 
+  - Filesystem.process_id
+  - Filesystem.file_name 
+  - Filesystem.file_path 
+  - Filesystem.dest
+  security_domain: endpoint
+  impact: 80
+  confidence: 50
+  risk_score: 40
\ No newline at end of file
diff --git a/tests/endpoint/windows_iso_lnk_file_creation.test.yml b/tests/endpoint/windows_iso_lnk_file_creation.test.yml
new file mode 100644
index 0000000000..6c10b8b783
--- /dev/null
+++ b/tests/endpoint/windows_iso_lnk_file_creation.test.yml
@@ -0,0 +1,12 @@
+name: Windows ISO LNK File Creation Unit Test
+tests:
+- name: 'Windows ISO LNK File Creation'
+  file: endpoint/windows_iso_lnk_file_creation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: iso_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 52a0c29a9c679c08d672abaa866d0cfc5eb157e9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 30 Mar 2022 14:48:01 -0600
Subject: [PATCH 02/18] Update windows_iso_lnk_file_creation.yml

---
 detections/endpoint/windows_iso_lnk_file_creation.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml
index 6c9a0d438a..55711343d9 100644
--- a/detections/endpoint/windows_iso_lnk_file_creation.yml
+++ b/detections/endpoint/windows_iso_lnk_file_creation.yml
@@ -29,7 +29,6 @@ tags:
   - CIS 16
   context:
   - Source:Endpoint
-  - Stage:Delivery
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon.log
   kill_chain_phases:

From 4df4b266ce4d505d797aa608010cd7e33bac615f Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 31 Mar 2022 09:11:18 -0600
Subject: [PATCH 03/18] SafeBoot

---
 .../start_up_during_safe_mode_boot.yml        | 70 -----------------
 ...modification_for_safe_mode_persistence.yml | 78 +++++++++++++++++++
 ...cation_for_safe_mode_persistence.test.yml} |  6 +-
 3 files changed, 81 insertions(+), 73 deletions(-)
 delete mode 100644 detections/endpoint/start_up_during_safe_mode_boot.yml
 create mode 100644 detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
 rename tests/endpoint/{start_up_during_safe_mode_boot.test.yml => windows_registry_modification_for_safe_mode_persistence.test.yml} (63%)

diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml
deleted file mode 100644
index 5c29c26610..0000000000
--- a/detections/endpoint/start_up_during_safe_mode_boot.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-name: Start Up During Safe Mode Boot
-id: c6149154-c9d8-11eb-9da7-acde48001122
-version: 2
-date: '2022-01-26'
-author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
-description: This search is to detect a modification or registry add to the safeboot
-  registry as an autostart mechanism. This technique was seen in some ransomware to
-  automatically execute its code upon a safe mode boot.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
-  where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*"
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
-  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
-  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
-  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
-  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
-  proc_guid | fields _time dest user parent_process_name parent_process process_name
-  process_path process proc_guid registry_path registry_value_name registry_value_data]
-  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data | `start_up_during_safe_mode_boot_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: updated windows application needed in safe boot may used this
-  registry
-references:
-- https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365
-tags:
-  analytic_story:
-  - Ransomware
-  confidence: 70
-  context:
-  - Source:Endpoint
-  - Stage:Persistence
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
-  impact: 60
-  kill_chain_phases:
-  - Exploitation
-  message: Safeboot registry $registry_path$ was added or modified with a new value
-    $registry_value_name$ on $dest$
-  mitre_attack_id:
-  - T1547.001
-  - T1547
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
-  risk_score: 42
-  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
-  asset_type: Endpoint
diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
new file mode 100644
index 0000000000..84c33bb6cd
--- /dev/null
+++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
@@ -0,0 +1,78 @@
+name: 'Windows Registry Modification for Safe Mode Persistence'
+id: c6149154-c9d8-11eb-9da7-acde48001122
+version: 3
+date: '2022-03-31'
+author: Teoderick Contreras, Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a modification or registry add to the safeboot registry as an autostart mechanism. This technique is utilized by adversaries to persist a driver or service into Safe Mode. Two keys are monitored in this analytic,  Minimal and Network. 
+  adding values to Minimal will load into Safe Mode and by adding into Network it will provide the service or drive the ability to perform network connections in Safe Mode. 
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*")
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
+  | `drop_dm_object_name(Registry)` 
+  | join process_guid _time 
+  [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid 
+  | `drop_dm_object_name(Processes)`]
+  | table
+  _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name
+  | `windows_registry_modification_for_safe_mode_persistence_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: updated windows application needed in safe boot may used this
+  registry
+references:
+- https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365
+- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md
+- https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/
+tags:
+  analytic_story:
+  - Ransomware
+  - Windows Registry Abuse
+  - Windows Rootkits
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Safeboot registry $registry_path$ was added or modified with a new value
+    $registry_value_name$ on $dest$
+  mitre_attack_id:
+  - T1547.001
+  - T1547
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Processes.process_id 
+  - Processes.process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.process_guid 
+  risk_score: 42
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  asset_type: Endpoint
diff --git a/tests/endpoint/start_up_during_safe_mode_boot.test.yml b/tests/endpoint/windows_registry_modification_for_safe_mode_persistence.test.yml
similarity index 63%
rename from tests/endpoint/start_up_during_safe_mode_boot.test.yml
rename to tests/endpoint/windows_registry_modification_for_safe_mode_persistence.test.yml
index aa3c92429d..7356405433 100644
--- a/tests/endpoint/start_up_during_safe_mode_boot.test.yml
+++ b/tests/endpoint/windows_registry_modification_for_safe_mode_persistence.test.yml
@@ -1,7 +1,7 @@
-name: Start Up During Safe Mode Boot Unit Test
+name: Windows Registry Modification for Safe Mode Persistence Unit Test
 tests:
-- name: Start Up During Safe Mode Boot
-  file: endpoint/start_up_during_safe_mode_boot.yml
+- name: 'Windows Registry Modification for Safe Mode Persistence'
+  file: endpoint/windows_registry_modification_for_safe_mode_persistence.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now

From 11a3cff09ee581158d926f9f39ddd388043cc68a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 31 Mar 2022 14:17:39 -0600
Subject: [PATCH 04/18] Cert Registry

---
 .../windows_registry_certificate_added.yml    | 80 +++++++++++++++++++
 ...indows_registry_certificate_added.test.yml | 12 +++
 2 files changed, 92 insertions(+)
 create mode 100644 detections/endpoint/windows_registry_certificate_added.yml
 create mode 100644 tests/endpoint/windows_registry_certificate_added.test.yml

diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml
new file mode 100644
index 0000000000..22b0984126
--- /dev/null
+++ b/detections/endpoint/windows_registry_certificate_added.yml
@@ -0,0 +1,80 @@
+name: Windows Registry Certificate Added
+id: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87
+version: 1
+date: '2022-03-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to (SetValue) when a new certificate is added. \
+  
+  The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with “<THUMBPRINT_VALUE>\Blob” as this indicates the direct installation or modification of a root certificate binary blob. To further drill down if a certificate is malicious, PowerShell may be ran \
+
+  `Get-ChildItem -Path Cert:\ -Recurse | Where-Object { $_.Thumbprint -eq '0022882F61DA349DE9FE5CD1C9EBA96AD7BDF266' } | Format-List *` 
+  
+  The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning.'
+
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path IN ("*\\Certificates\\*") AND Registry.registry_value_name="Blob"
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
+  | `drop_dm_object_name(Registry)` 
+  | join process_guid _time 
+  [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid 
+  | `drop_dm_object_name(Processes)`]
+  | table
+  _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name
+  | `windows_registry_certificate_added_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be limited to a legitimate business applicating consistently adding new root certificates to the endpoint. Filter by user, process, or thumbprint.
+references:
+- https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
+- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1587.002
+tags:
+  analytic_story:
+  - Windows Rootkits
+  - Windows Registry Abuse
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: A root certificate was added on $dest$. 
+  mitre_attack_id:
+  - T1587.002
+  - T1587
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Processes.process_id 
+  - Processes.process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.process_guid 
+  risk_score: 42
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  asset_type: Endpoint
diff --git a/tests/endpoint/windows_registry_certificate_added.test.yml b/tests/endpoint/windows_registry_certificate_added.test.yml
new file mode 100644
index 0000000000..28fe2d8981
--- /dev/null
+++ b/tests/endpoint/windows_registry_certificate_added.test.yml
@@ -0,0 +1,12 @@
+name: Windows Registry Certificate Added Unit Test
+tests:
+- name: Windows Registry Certificate Added
+  file: endpoint/windows_registry_certificate_added.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: certblob_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From c4f9d3cbd619ebc3424548c1d42d338dc6ccfa3c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 31 Mar 2022 14:23:14 -0600
Subject: [PATCH 05/18] Update windows_registry_certificate_added.yml

---
 detections/endpoint/windows_registry_certificate_added.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml
index 22b0984126..cc3db05144 100644
--- a/detections/endpoint/windows_registry_certificate_added.yml
+++ b/detections/endpoint/windows_registry_certificate_added.yml
@@ -10,7 +10,7 @@ description: 'The following analytic identifies installation of a root CA certif
   
   The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with “<THUMBPRINT_VALUE>\Blob” as this indicates the direct installation or modification of a root certificate binary blob. To further drill down if a certificate is malicious, PowerShell may be ran \
 
-  `Get-ChildItem -Path Cert:\ -Recurse | Where-Object { $_.Thumbprint -eq '0022882F61DA349DE9FE5CD1C9EBA96AD7BDF266' } | Format-List *` 
+  `Get-ChildItem -Path Cert:\ -Recurse | Where-Object { $_.Thumbprint -eq ''0022882F61DA349DE9FE5CD1C9EBA96AD7BDF266'' } | Format-List *` 
   
   The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning.'
 

From fdc6b5aeb8bbf31c859b4feb33c2fe086d198d8a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 31 Mar 2022 15:05:56 -0600
Subject: [PATCH 06/18] Update windows_registry_certificate_added.yml

---
 .../endpoint/windows_registry_certificate_added.yml      | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml
index cc3db05144..64738185fc 100644
--- a/detections/endpoint/windows_registry_certificate_added.yml
+++ b/detections/endpoint/windows_registry_certificate_added.yml
@@ -6,14 +6,9 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: 'The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to (SetValue) when a new certificate is added. \
-  
-  The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with “<THUMBPRINT_VALUE>\Blob” as this indicates the direct installation or modification of a root certificate binary blob. To further drill down if a certificate is malicious, PowerShell may be ran \
-
-  `Get-ChildItem -Path Cert:\ -Recurse | Where-Object { $_.Thumbprint -eq ''0022882F61DA349DE9FE5CD1C9EBA96AD7BDF266'' } | Format-List *` 
-  
+description: 'The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to (SetValue) when a new certificate is added.
+  The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with "<THUMBPRINT_VALUE>\Blob" as this indicates the direct installation or modification of a root certificate binary blob.
   The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning.'
-
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path IN ("*\\Certificates\\*") AND Registry.registry_value_name="Blob"
   by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 

From 48aacaf909a40fd5af16fa4fa4e6b0d3fe9ba4b0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 1 Apr 2022 07:31:52 -0600
Subject: [PATCH 07/18] Update windows_registry_certificate_added.yml

---
 detections/endpoint/windows_registry_certificate_added.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml
index 64738185fc..f05718ed6e 100644
--- a/detections/endpoint/windows_registry_certificate_added.yml
+++ b/detections/endpoint/windows_registry_certificate_added.yml
@@ -24,7 +24,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: False positives will be limited to a legitimate business applicating consistently adding new root certificates to the endpoint. Filter by user, process, or thumbprint.
 references:
 - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
-- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1587.002
+- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1553.004
 tags:
   analytic_story:
   - Windows Rootkits
@@ -44,8 +44,8 @@ tags:
   - Exploitation
   message: A root certificate was added on $dest$. 
   mitre_attack_id:
-  - T1587.002
-  - T1587
+  - T1553.004
+  - T1553
   nist:
   - DE.CM
   observable:

From 4c7bd7a66c708204b122972d3d634710793650d1 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 4 Apr 2022 14:02:02 -0600
Subject: [PATCH 08/18] driver load by sig

---
 .../windows_drivers_loaded_by_signature.yml   | 68 +++++++++++++++++++
 ...ndows_drivers_loaded_by_signature.test.yml | 12 ++++
 2 files changed, 80 insertions(+)
 create mode 100644 detections/endpoint/windows_drivers_loaded_by_signature.yml
 create mode 100644 tests/endpoint/windows_drivers_loaded_by_signature.test.yml

diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml
new file mode 100644
index 0000000000..7ee603a4b1
--- /dev/null
+++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml
@@ -0,0 +1,68 @@
+name: Windows Drivers Loaded by Signature
+id: d2d4af6a-6c2b-4d79-80c5-fc2cf12a2f68
+version: 1
+date: '2022-03-30'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic assists with viewing all drivers being loaded by using Sysmon EventCode 6 (Driver Load). Sysmon provides some simple fields to assist with identifying suspicious drivers.
+  Use this analytic to look at prevalence of driver (count), path of driver, signature status and hash. Review these fields with scrutiny until the ability to prove the driver is legitimate and has a purpose in the environment.
+search: '`sysmon` EventCode=6 
+| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) count by Computer Signed Signature service_signature_verified service_signature_exists Hashes
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_drivers_loaded_by_signature_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have the latest version of the Sysmon TA. 
+  Most EDR products provide the ability to review driver loads, or module loads, and using a query as such help with hunting for malicious drivers.
+known_false_positives: This analytic is meant to assist with identifying drivers loaded in the environment and not to be setup for notables off the bat.
+references:
+  - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
+  - https://attack.mitre.org/techniques/T1014/
+  - https://www.fuzzysecurity.com/tutorials/28.html
+tags:
+  analytic_story:
+  - Windows Rootkits
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: A driver has loaded on $Computer$. 
+  mitre_attack_id:
+  - T1014
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ImageLoaded
+  - Computer
+  - Signed
+  - Signature
+  - service_signature_verified
+  - service_signature_exists
+  - Hashes
+  risk_score: 42
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  asset_type: Endpoint
diff --git a/tests/endpoint/windows_drivers_loaded_by_signature.test.yml b/tests/endpoint/windows_drivers_loaded_by_signature.test.yml
new file mode 100644
index 0000000000..0a6ee89bd6
--- /dev/null
+++ b/tests/endpoint/windows_drivers_loaded_by_signature.test.yml
@@ -0,0 +1,12 @@
+name: Windows Drivers Loaded by Signature Unit Test
+tests:
+- name: Windows Drivers Loaded by Signature
+  file: endpoint/windows_drivers_loaded_by_signature.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From cab258e21144dabfe3670669d210190d3aecd8fe Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 12 Apr 2022 15:29:20 -0600
Subject: [PATCH 09/18] Update windows_registry_certificate_added.yml

---
 detections/endpoint/windows_registry_certificate_added.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml
index f05718ed6e..7d171d18f7 100644
--- a/detections/endpoint/windows_registry_certificate_added.yml
+++ b/detections/endpoint/windows_registry_certificate_added.yml
@@ -10,7 +10,7 @@ description: 'The following analytic identifies installation of a root CA certif
   The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with "<THUMBPRINT_VALUE>\Blob" as this indicates the direct installation or modification of a root certificate binary blob.
   The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning.'
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
-  where Registry.registry_path IN ("*\\Certificates\\*") AND Registry.registry_value_name="Blob"
+  where Registry.registry_path IN ("*\\certificates\\*") AND Registry.registry_value_name="Blob"
   by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
   | `drop_dm_object_name(Registry)` 
   | join process_guid _time 

From b25fc779c3d986cad74e586ad949a91f047d70d2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 14 Apr 2022 13:20:46 -0600
Subject: [PATCH 10/18] Update
 ssa___windows_lolbin_binary_in_non_standard_path.yml

---
 ...___windows_lolbin_binary_in_non_standard_path.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 3666dac81f..1cf1a64509 100644
--- a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint_Processes
 description: The following analytic identifies native living off the land binaries within the Windows
   operating system that may be abused by adversaries by moving it to a new directory.
-  The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
+  The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe, regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
 search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
   "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
   "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
@@ -16,13 +16,13 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
-  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR process_name="cmd.exe" OR 
-  process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="csc.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
-  process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="explorer.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
-  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="hh.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe" OR 
+  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
+  process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
+  process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
+  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe" OR 
   process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
   process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
-  process_name="reg.exe" OR process_name="regedit.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
+  process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
   process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
 
   | from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false

From be60ac00b4d665e0eb9315c27f613748f609d845 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 14 Apr 2022 13:39:00 -0600
Subject: [PATCH 11/18] Revert "Update
 ssa___windows_lolbin_binary_in_non_standard_path.yml"

This reverts commit b25fc779c3d986cad74e586ad949a91f047d70d2.
---
 ...___windows_lolbin_binary_in_non_standard_path.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 1cf1a64509..3666dac81f 100644
--- a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint_Processes
 description: The following analytic identifies native living off the land binaries within the Windows
   operating system that may be abused by adversaries by moving it to a new directory.
-  The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe, regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
+  The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
 search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
   "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
   "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
@@ -16,13 +16,13 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
-  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
-  process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
-  process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
-  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe" OR 
+  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR process_name="cmd.exe" OR 
+  process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="csc.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
+  process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="explorer.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
+  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="hh.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe" OR 
   process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
   process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
-  process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
+  process_name="reg.exe" OR process_name="regedit.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
   process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
 
   | from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false

From 12350f451ee536a8b07a2de9c87f526292fe0faf Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 18 Apr 2022 10:01:25 -0600
Subject: [PATCH 12/18] Update nltest_domain_trust_discovery.yml

---
 detections/endpoint/nltest_domain_trust_discovery.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml
index 6fe704a81e..26070b6bfe 100644
--- a/detections/endpoint/nltest_domain_trust_discovery.yml
+++ b/detections/endpoint/nltest_domain_trust_discovery.yml
@@ -1,7 +1,7 @@
 name: NLTest Domain Trust Discovery
 id: c3e05466-5f22-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-25'
+version: 2
+date: '2022-04-18'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -12,8 +12,7 @@ description: This search looks for the execution of `nltest.exe` with command-li
   domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current
   domain to assist with further understanding where to pivot next.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe
-  OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
+  as lastTime from datamodel=Endpoint.Processes where `process_nltest` (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter`'

From 6ba1225077d8096ddb0c4319be6c6097a29df63c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 18 Apr 2022 10:55:08 -0600
Subject: [PATCH 13/18] SD Delete

---
 .../windows_registry_delete_task_sd.yml       | 70 +++++++++++++++++++
 .../windows_registry_delete_task_sd.test.yml  | 12 ++++
 2 files changed, 82 insertions(+)
 create mode 100644 detections/endpoint/windows_registry_delete_task_sd.yml
 create mode 100644 tests/endpoint/windows_registry_delete_task_sd.test.yml

diff --git a/detections/endpoint/windows_registry_delete_task_sd.yml b/detections/endpoint/windows_registry_delete_task_sd.yml
new file mode 100644
index 0000000000..00d7ff61c4
--- /dev/null
+++ b/detections/endpoint/windows_registry_delete_task_sd.yml
@@ -0,0 +1,70 @@
+name: Windows Registry Delete Task SD
+id: ffeb7893-ff06-446f-815b-33ca73224e92
+version: 1
+date: '2022-04-13'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task.
+  This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. 
+  In addition, in order to perform this action, the user context will need to be SYSTEM.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*") Registry.user="SYSTEM" Registry.registry_value_name="SD" (Registry.action=Deleted OR Registry.action=modified)
+  by _time  Registry.dest Registry.process_guid Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.registry_value_data Registry.status Registry.action
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_registry_delete_task_sd_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives should be limited as the activity is not common to delete ONLY the SD from the registry. Filter as needed.
+references:
+- https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
+- https://gist.github.com/MHaggis/5f7fd6745915166fc6da863d685e2728
+- https://gist.github.com/MHaggis/b246e2fae6213e762a6e694cabaf0c17
+tags:
+  analytic_story:
+  - Windows Registry Abuse
+  - Windows Persistence Techniques
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Installation
+  mitre_attack_id:
+  - T1053.005
+  - T1562
+  nist:
+  - DE.CM
+  message: A scheduled task security descriptor was deleted from the registry on $dest$. 
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Processes.process_id 
+  - Processes.process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.process_guid 
+  risk_score: 49
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_registry_delete_task_sd.test.yml b/tests/endpoint/windows_registry_delete_task_sd.test.yml
new file mode 100644
index 0000000000..dfc277bda6
--- /dev/null
+++ b/tests/endpoint/windows_registry_delete_task_sd.test.yml
@@ -0,0 +1,12 @@
+name: Windows Registry Delete Task SD Unit Test
+tests:
+- name: Windows Registry Delete Task SD
+  file: endpoint/windows_registry_delete_task_sd.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sd_delete_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From abd668b260e64127d04a6578dd587bba466d3c7f Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 22 Apr 2022 10:21:29 -0600
Subject: [PATCH 14/18] updates and story

---
 .../windows_registry_certificate_added.yml    |  2 +-
 ...modification_for_safe_mode_persistence.yml |  2 +-
 stories/windows_drivers.yml                   | 20 +++++++++++++++++++
 3 files changed, 22 insertions(+), 2 deletions(-)
 create mode 100644 stories/windows_drivers.yml

diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml
index 7d171d18f7..775a61ffcd 100644
--- a/detections/endpoint/windows_registry_certificate_added.yml
+++ b/detections/endpoint/windows_registry_certificate_added.yml
@@ -27,7 +27,7 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1553.004
 tags:
   analytic_story:
-  - Windows Rootkits
+  - Windows Drivers
   - Windows Registry Abuse
   cis20:
   - CIS 3
diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
index 84c33bb6cd..b875a317fb 100644
--- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
+++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
@@ -36,7 +36,7 @@ tags:
   analytic_story:
   - Ransomware
   - Windows Registry Abuse
-  - Windows Rootkits
+  - Windows Drivers
   confidence: 70
   context:
   - Source:Endpoint
diff --git a/stories/windows_drivers.yml b/stories/windows_drivers.yml
new file mode 100644
index 0000000000..71b229e4ad
--- /dev/null
+++ b/stories/windows_drivers.yml
@@ -0,0 +1,20 @@
+name: Windows Drivers
+id: d0a9323f-9411-4da6-86b2-18c184d750c0
+version: 1
+date: '2022-03-30'
+author: Michael Haag, Splunk
+description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
+narrative: A rootkit on Windows may sometimes be in the form of a Windows Driver. A driver typically has a file extension of .sys, however the internals of a sys file is similar to a Windows DLL. For Microsoft Windows to load a driver, a few requirements are needed. First, it must have a valid signature. Second, typically it should load from the windows\system32\drivers path.
+  There are a few methods to investigate drivers in the environment. Drivers are noisy. An inventory of all drivers is important to understand prevalence. A driver location (Path) is also important when attempting to baseline. Looking at a driver name and path is not enough, we must also explore the signing information. Product, description, company name, signer and signing result are all items to take into account when reviewing drivers.
+  What makes a driver malicious? Depending if a driver was dropped during a campaign or you are baselining drivers after, triaging a driver to determine maliciousness may be tough. We break this into two categories - 1. vulnerable drivers 2. driver rootkits. Attempt to identify prevelance of the driver. Is it on one or many?
+  Review the signing information if it is present. Is it common? A lot of driver hunting will lead down rabbit holes, but we hope to help lead the way. 
+references: 
+  - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
+tags:
+  analytic_story: Windows Drivers
+  category: []
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

From 7d4e75523fad9c9dfcdd7aa2aa4f4b27150e2001 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 22 Apr 2022 10:32:33 -0600
Subject: [PATCH 15/18] Update windows_drivers_loaded_by_signature.yml

---
 detections/endpoint/windows_drivers_loaded_by_signature.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml
index 7ee603a4b1..744bcfb830 100644
--- a/detections/endpoint/windows_drivers_loaded_by_signature.yml
+++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml
@@ -24,7 +24,7 @@ references:
   - https://www.fuzzysecurity.com/tutorials/28.html
 tags:
   analytic_story:
-  - Windows Rootkits
+  - Windows Drivers
   cis20:
   - CIS 3
   - CIS 5

From e04e3690f864995b4455788c7c2a5bce41e5d5a1 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 22 Apr 2022 11:37:08 -0600
Subject: [PATCH 16/18] Update windows_registry_delete_task_sd.yml

---
 detections/endpoint/windows_registry_delete_task_sd.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_registry_delete_task_sd.yml b/detections/endpoint/windows_registry_delete_task_sd.yml
index 00d7ff61c4..37e045b7b4 100644
--- a/detections/endpoint/windows_registry_delete_task_sd.yml
+++ b/detections/endpoint/windows_registry_delete_task_sd.yml
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   | `security_content_ctime(lastTime)`
   | `windows_registry_delete_task_sd_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives should be limited as the activity is not common to delete ONLY the SD from the registry. Filter as needed.
+known_false_positives: False positives should be limited as the activity is not common to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified or Deleted values based on product that is in the datamodel.
 references:
 - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
 - https://gist.github.com/MHaggis/5f7fd6745915166fc6da863d685e2728

From 324b7b9dfc490cb89d6ea7151625a0d606e70772 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Mon, 25 Apr 2022 13:44:30 -0400
Subject: [PATCH 17/18] Update windows_iso_lnk_file_creation.yml

minor change
---
 detections/endpoint/windows_iso_lnk_file_creation.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml
index 55711343d9..73c352f48f 100644
--- a/detections/endpoint/windows_iso_lnk_file_creation.yml
+++ b/detections/endpoint/windows_iso_lnk_file_creation.yml
@@ -1,4 +1,4 @@
-name: 'Windows ISO LNK File Creation'
+name: Windows ISO LNK File Creation
 id: d7c2c09b-9569-4a9e-a8b6-6a39a99c1d32
 version: 1
 date: '2022-03-29'
@@ -59,4 +59,4 @@ tags:
   security_domain: endpoint
   impact: 80
   confidence: 50
-  risk_score: 40
\ No newline at end of file
+  risk_score: 40

From 93b1f025dc83cb04752b8de36f9dd3598bcadb5a Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Mon, 25 Apr 2022 13:46:43 -0400
Subject: [PATCH 18/18] Update
 windows_registry_modification_for_safe_mode_persistence.yml

---
 .../windows_registry_modification_for_safe_mode_persistence.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
index b875a317fb..cc5223ce80 100644
--- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
+++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
@@ -1,4 +1,4 @@
-name: 'Windows Registry Modification for Safe Mode Persistence'
+name: Windows Registry Modification for Safe Mode Persistence
 id: c6149154-c9d8-11eb-9da7-acde48001122
 version: 3
 date: '2022-03-31'