macro ymls and detection update

detections/attrib_to_hide_files.yml

@@ -30,6 +30,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 50
+      macros:
+        - attrib_to_hide_files_filter
       schedule:
         cron_schedule: 30 * * * *
         earliest_time: -70m@m
@@ -38,7 +40,7 @@ detect:
         as process max(_time) as lastTime from datamodel=Endpoint.Processes where
         Processes.process_name=attrib.exe (Processes.process=*+h*) by Processes.parent_process
         Processes.process_name Processes.user | `drop_dm_object_name("Processes")`
-        | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`'
+        | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| `attrib_to_hide_files_filter`'
       suppress:
         suppress_fields: dest, process
         suppress_period: 86400s

detections/change_file_association.yml

@@ -27,6 +27,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 40
+      macros:
+        - change_file_association_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -39,7 +41,7 @@ detect:
         | join [| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path
         count  FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts*
         by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` |
-        table process_id dest registry_path]'
+        table process_id dest registry_path]| `change_file_association_filter`'
       suppress:
         suppress_fields: dest,user
         suppress_period: 28800s

detections/children_of_spoolsv.yml

@@ -28,6 +28,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 60
+      macros:
+        - children_of_spoolsv_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -36,7 +38,7 @@ detect:
         values(Processes.process) as process min(_time) as firstTime max(_time) as
         lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe
         AND Processes.process_name!=regsvr32.exe by Processes.dest Processes.parent_process
-        Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+        Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `children_of_spoolsv_filter`'
       suppress:
         suppress_fields: dest, parent_process_name
         suppress_period: 86400s
@@ -50,7 +52,7 @@ entities:
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+  field in the Endpoint data model. Update the `children_of_spoolsv_filter` macro to filter out legitimate child processes spawned by spoolsv.exe.
 id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df
 investigations:
   - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
@@ -97,7 +99,7 @@ mappings:
     - PR.AC
     - PR.PT
     - DE.CM
-modification_date: '2018-12-03'
+modification_date: '2020-07-03'
 name: Child Processes of Spoolsv.exe
 original_authors:
   - company: Splunk

detections/common_ransomware_extensions.yml

@@ -25,6 +25,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 80
+      macros:
+        - common_ransomware_extensions_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -33,7 +35,7 @@ detect:
         lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
         as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name |
         `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|
-        rex field=file_name "(?<file_extension>\.[^\.]+)$" | `ransomware_extensions`'
+        rex field=file_name "(?<file_extension>\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`'
       suppress:
         suppress_fields: dest,file_name
         suppress_period: 14400s

detections/common_ransomware_notes.yml

@@ -25,6 +25,9 @@ detect:
         risk_object_type:
           - system
         risk_score: 80
+      macros:
+        - common_ransomware_notes_filter
+        - ransomware_notes
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -32,7 +35,7 @@ detect:
       search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as
         lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
         as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name |
-        `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`ransomware_notes`'
+        `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`ransomware_notes`| `common_ransomware_notes_filter`'
       suppress:
         suppress_fields: dest,file_name
         suppress_period: 14400s

detections/create_local_admin_via_net.yml

@@ -27,6 +27,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 50
+      macros:
+        - create_local_admin_via_net_filter
       schedule:
         cron_schedule: 0 8 * * *
         earliest_time: -1440m@m
@@ -36,7 +38,7 @@ detect:
         where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by
         Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)`
         | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`  | search (process=*localgroup* OR
-        process=*/add* OR process=*user*)'
+        process=*/add* OR process=*user*) |`create_local_admin_via_net_filter`'
       suppress:
         suppress_fields: dest
         suppress_period: 86400s

detections/dragonfly_schtasks.yml

@@ -29,6 +29,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 80
+      macros:
+        - dragonfly_schtasks_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -38,7 +40,7 @@ detect:
         max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe  by
         Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
         `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |
-        search (process=*delete* OR process=*create*) process=*reset*'
+        search (process=*delete* OR process=*create*) process=*reset* | `dragonfly_schtasks_filter`'
       suppress:
         suppress_fields: dest, process_name, process
         suppress_period: 28800s

detections/file_write_spikes.yml

@@ -26,6 +26,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 30
+      macros:
+        - file_write_spikes_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -7d@d
@@ -37,7 +39,7 @@ detect:
         "-1d@d"), count,null))) as avg stdev(eval(if(_time<relative_time(maxtime,
         "-1d@d"), count, null))) as stdev by "dest" | eval upperBound=(avg+stdev*4),
         isOutlier=if((count > upperBound) AND num_data_samples >=20, 1, 0) | search
-        isOutlier=1'
+        isOutlier=1 | `file_write_spikes_filter`'
       suppress:
         suppress_fields: dest
         suppress_period: 7200s

detections/lnk_executing_a_process.yml

@@ -28,6 +28,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 40
+      macros:
+        - lnk_executing_a_process_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -44,7 +46,7 @@ detect:
         | rename parent_process_id as lnk_pid | fields _time lnk_pid process_id dest
         process_name process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
         | table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path,
-        process_name, process, process_path, file_hash'
+        process_name, process, process_path, file_hash | `lnk_executing_a_process_filter`'
       suppress:
         suppress_fields: dest,file_name
         suppress_period: 86400s

detections/outlook_writing_zip.yml

@@ -27,6 +27,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 20
+      macros:
+        - outlook_writing_zip_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -45,7 +47,7 @@ detect:
         | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename process_id as malicious_id|
         fields malicious_id outlook_id dest file_path file_name file_hash count file_id]
         | table firstTime lastTime user malicious_id outlook_id process_name parent_process_name
-        file_name  file_path | where file_name != ""'
+        file_name  file_path | where file_name != "" | `outlook_writing_zip_filter`'
       suppress:
         suppress_fields: dest,file_name
         suppress_period: 86400s

detections/rare_executables_on_endpoint.yml

@@ -27,6 +27,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 20
+      macros:
+        - rare_executables_on_endpoint_filter
       schedule:
         cron_schedule: 10 * * * *
         earliest_time: -70m@m
@@ -38,7 +40,7 @@ detect:
         `security_content_ctime(lastTime)`| search [| tstats count from datamodel=Endpoint.Processes
         by Processes.process_name | rare Processes.process_name limit=30 | rename
         Processes.process_name as process| `filter_rare_process_whitelist`| table
-        process ]'
+        process ] | `rare_executables_on_endpoint_filter`'
       suppress:
         suppress_fields: dest, process
         suppress_period: 86400s

detections/suspicious_reg_process.yml

@@ -28,6 +28,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 80
+      macros:
+        - suspicious_reg_process_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -41,7 +43,7 @@ detect:
         where Processes.parent_process_name=cmd.exe Processes.process_name= reg.exe
         by Processes.parent_process_id Processes.dest Processes.process_name | `drop_dm_object_name("Processes")`
         | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename parent_process_id as process_id
-        |dedup process_id| table process_id dest]'
+        |dedup process_id| table process_id dest] | `suspicious_reg_process_filter`'
       suppress:
         suppress_fields: dest, user
         suppress_period: 14400s

detections/uncommon_processes.yml

@@ -27,6 +27,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 50
+      macros:
+        - uncommon_processes_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -34,7 +36,7 @@ detect:
       search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as
         lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user
         Processes.process Processes.process_name | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-        | `drop_dm_object_name(Processes)` | `uncommon_processes`'
+        | `drop_dm_object_name(Processes)` | `uncommon_processes` |`uncommon_processes_filter`'
       suppress:
         suppress_fields: dest, user
         suppress_period: 86400s

detections/unusually_long_commandlines.yml

@@ -26,6 +26,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 50
+      macros:
+        - unusually_long_commandlines_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -1d@d
@@ -36,7 +38,7 @@ detect:
         | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|  eval processlen=len(process) | eventstats
         stdev(processlen) as stdev, avg(processlen) as avg by dest | stats max(processlen)
         as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest,
-        user, process_name, process| eval threshold = 10 | where maxlen > ((threshold*stdevperhost)
+        user, process_name, process| `unusually_long_commandlines_filter`| eval threshold = 10 | where maxlen > ((threshold*stdevperhost)
         + avgperhost)'
       suppress:
         suppress_fields: dest,user,process

detections/wmi_process_launch.yml

@@ -25,6 +25,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 70
+      macros:
+        - wmi_process_launch_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -33,7 +35,7 @@ detect:
         min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
         where Processes.parent_process_name = *WmiPrvSE.exe by Processes.user Processes.dest
         Processes.process_name  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|
-        `security_content_ctime(lastTime)`'
+        `security_content_ctime(lastTime)`| `wmi_process_launch_filter`'
       suppress:
         suppress_fields: dest, user
         suppress_period: 28800s

detections/wmi_script_execution.yml

@@ -25,6 +25,8 @@ detect:
         risk_object_type:
           - system
         risk_score: 70
+      macros:
+        - wmi_script_execution_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -33,7 +35,7 @@ detect:
         min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
         where Processes.process_name = "scrcons.exe" by Processes.user Processes.dest
         Processes.process_name  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|
-        `security_content_ctime(lastTime)`'
+        `security_content_ctime(lastTime)`| `wmi_script_execution_filter`'
       suppress:
         suppress_fields: dest,process
         suppress_period: 28800s

macros/attrib_to_hide_files_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: attrib_to_hide_files_filter

macros/change_file_association_filter.yml

@@ -0,0 +1,4 @@
+
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: change_file_association_filter

macros/children_of_spoolsv_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: children_of_spoolsv_filter

macros/common_ransomware_extensions_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: common_ransomware_extensions_filter

macros/common_ransomware_notes_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: common_ransomware_notes_filter

macros/create_local_admin_via_net_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: create_local_admin_via_net_filter

macros/dragonfly_schtasks_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: dragonfly_schtasks_filter

macros/file_write_spikes_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: file_write_spikes_filter

macros/lnk_executing_a_process_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: lnk_executing_a_process_filter

macros/outlook_writing_zip_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: outlook_writing_zip_filter

macros/rare_executables_on_endpoint_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to filter out false positives
+name: rare_executables_on_endpoint_filter

macros/suspicious_reg_process_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: suspicious_reg_process_filter

macros/uncommon_processes_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: uncommon_processes_filter

macros/unusually_long_commandlines_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: unusually_long_commandlines_filter

macros/wmi_process_launch_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: wmi_process_launch_filter

macros/wmi_script_execution_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: wmi_script_execution_filter