From c4f3cf78999e86b60d6a8b3e0a61a28ce0f8b860 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 19 Aug 2021 15:45:36 +0200
Subject: [PATCH 01/31] dev_sec2

---
 ...ail_suspicious_subject_with_attachment.yml | 64 +++++++++++++++++++
 ...uspicious_subject_with_attachment.test.yml | 12 ++++
 2 files changed, 76 insertions(+)
 create mode 100644 detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
 create mode 100644 tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml

diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
new file mode 100644
index 0000000000..830034e639
--- /dev/null
+++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
@@ -0,0 +1,64 @@
+name: Gsuite Email Suspicious Subject With Attachment
+id: 8ef3971e-00f2-11ec-b54f-acde48001122
+version: 1
+date: '2021-08-19'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+- Email
+- Updates
+description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing.
+  This technique is really a very common and effective entry vector of attacker to compromise a network by clicking or running the suspicous attachment 
+  send from external email account. 
+search: '`gsuite_gmail` num_message_attachments > 0  
+  subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) 
+  attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) 
+  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
+  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
+  | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
+  | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by   
+  destination{}.service num_message_attachments  subject destination{}.address source.address
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `gsuite_email_suspicious_subject_with_attachment_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file 
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: normal user or normal transaction may contain the subject and file type attachment that 
+  this detection try to search.
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious email from $source.address$ to $destination{}.address$
+  observable:
+  - name: source.address
+    type: User
+    role:
+    - attacker
+  - name: destination{}.address 
+    type: User
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
new file mode 100644
index 0000000000..0e535c5fae
--- /dev/null
+++ b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
@@ -0,0 +1,12 @@
+name: Gsuite Email Suspicious Subject With Attachment Unit Test
+tests:
+- name: Gsuite Email Suspicious Subject With Attachment
+  file: detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file

From a2f338a91b5c23a1cf0b7069f0766e9c68a975f0 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 20 Aug 2021 10:40:33 +0200
Subject: [PATCH 02/31] dev_sec2

---
 ...gsuite_email_suspicious_subject_with_attachment.yml |  8 +++++---
 ...e_email_suspicious_subject_with_attachment.test.yml | 10 +++++-----
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
index 830034e639..99ca5cfd98 100644
--- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
@@ -9,8 +9,10 @@ datamodel:
 - Email
 - Updates
 description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing.
-  This technique is really a very common and effective entry vector of attacker to compromise a network by clicking or running the suspicous attachment 
-  send from external email account. 
+  This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment 
+  send from external email account because of the effective social engineering of subject related to delivery, bank and so on.
+  On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc.
+  avoid click link or opening the attachment if you are not expecting this type of e-mail. 
 search: '`gsuite_gmail` num_message_attachments > 0  
   subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) 
   attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) 
@@ -33,7 +35,7 @@ tags:
   analytic_story:
   - DevSecOps
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
index 0e535c5fae..c3cb0a32c8 100644
--- a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
+++ b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
@@ -1,12 +1,12 @@
 name: Gsuite Email Suspicious Subject With Attachment Unit Test
 tests:
 - name: Gsuite Email Suspicious Subject With Attachment
-  file: detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+  file: endpoint/gsuite_email_suspicious_subject_with_attachment.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: gsuite_susp_subj_attach.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
+    source: http:gsuite
+    sourcetype: gsuite:gmail:bigquery
\ No newline at end of file

From 476487d6d5dc97c77f298f898e690b951147952c Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 13:13:53 +0200
Subject: [PATCH 03/31] dev_sec2

---
 ...ail_suspicious_subject_with_attachment.yml |  1 +
 .../gsuite_suspicious_shared_file_name.yml    | 69 +++++++++++++++++++
 ...suite_suspicious_shared_file_name.test.yml | 12 ++++
 3 files changed, 82 insertions(+)
 create mode 100644 detections/endpoint/gsuite_suspicious_shared_file_name.yml
 create mode 100644 tests/endpoint/gsuite_suspicious_shared_file_name.test.yml

diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
index 99ca5cfd98..566f03c8a9 100644
--- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
@@ -31,6 +31,7 @@ known_false_positives: normal user or normal transaction may contain the subject
   this detection try to search.
 references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
+- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
 tags:
   analytic_story:
   - DevSecOps
diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
new file mode 100644
index 0000000000..f078dbcbeb
--- /dev/null
+++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
@@ -0,0 +1,69 @@
+name: Gsuite Suspicious Shared File Name
+id: 07eed200-03f5-11ec-98fb-acde48001122
+version: 1
+date: '2021-08-23'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+- Email
+description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. 
+  This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website.
+  This detection can also catch some normal email communication between organization and its external customer.
+search: 'index=obs-gsuite sourcetype=gsuite:drive:json parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
+  | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)"  
+  | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)"  
+  | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `gsuite_suspicious_shared_file_name_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file 
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: normal user or normal transaction may contain the subject and file type attachment that 
+  this detection try to search
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - parameters.doc_title
+  - src_domain
+  - dest_domain
+  - email
+  - parameters.visibility
+  - parameters.owner
+  - parameters.doc_type
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  # (impact * confidence)/100
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
+  observable:
+  - name: parameters.owner
+    type: User
+    role:
+    - attacker
+  - name: email
+    type: User
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml b/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml
new file mode 100644
index 0000000000..a59374a794
--- /dev/null
+++ b/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml
@@ -0,0 +1,12 @@
+name: Gsuite Suspicious Shared File Name Unit Test
+tests:
+- name: Gsuite Suspicious Shared File Name
+  file: endpoint/gsuite_suspicious_shared_file_name.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: gdrive_susp_attach.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
+    source: http:gsuite
+    sourcetype: gsuite:drive:json 
\ No newline at end of file

From 9a0227affd2700c6821ab1fd152b128290417d56 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 13:16:30 +0200
Subject: [PATCH 04/31] dev_sec2

---
 detections/endpoint/gsuite_suspicious_shared_file_name.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
index f078dbcbeb..87f2ecbb87 100644
--- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml
+++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
@@ -3,7 +3,7 @@ id: 07eed200-03f5-11ec-98fb-acde48001122
 version: 1
 date: '2021-08-23'
 author: Teoderick Contreras, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Endpoint
 - Email

From 64ef47d844deb20350ec831688a7eaff71a9f461 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 13:18:57 +0200
Subject: [PATCH 05/31] dev_sec2

---
 detections/endpoint/gsuite_suspicious_shared_file_name.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
index 87f2ecbb87..dda923e569 100644
--- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml
+++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
@@ -10,7 +10,7 @@ datamodel:
 description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. 
   This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website.
   This detection can also catch some normal email communication between organization and its external customer.
-search: 'index=obs-gsuite sourcetype=gsuite:drive:json parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
+search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
   | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)"  
   | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)"  
   | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 

From 99fb9f0c16999c1d00a8bcc224eaaeb88cefa953 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 17:30:20 +0200
Subject: [PATCH 06/31] dev_sec2

---
 .../gsuite_email_suspicious_subject_with_attachment.yml      | 5 +----
 .../gsuite_suspicious_shared_file_name.yml                   | 4 +---
 .../gsuite_email_suspicious_subject_with_attachment.test.yml | 2 +-
 .../gsuite_suspicious_shared_file_name.test.yml              | 2 +-
 4 files changed, 4 insertions(+), 9 deletions(-)
 rename detections/{endpoint => cloud}/gsuite_email_suspicious_subject_with_attachment.yml (98%)
 rename detections/{endpoint => cloud}/gsuite_suspicious_shared_file_name.yml (98%)
 rename tests/{endpoint => cloud}/gsuite_email_suspicious_subject_with_attachment.test.yml (87%)
 rename tests/{endpoint => cloud}/gsuite_suspicious_shared_file_name.test.yml (89%)

diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
similarity index 98%
rename from detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
rename to detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
index 566f03c8a9..cba0a58be3 100644
--- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
@@ -4,10 +4,7 @@ version: 1
 date: '2021-08-19'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
-- Email
-- Updates
+datamodel: []
 description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing.
   This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment 
   send from external email account because of the effective social engineering of subject related to delivery, bank and so on.
diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml
similarity index 98%
rename from detections/endpoint/gsuite_suspicious_shared_file_name.yml
rename to detections/cloud/gsuite_suspicious_shared_file_name.yml
index dda923e569..9b7bd30b24 100644
--- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml
+++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml
@@ -4,9 +4,7 @@ version: 1
 date: '2021-08-23'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
-- Email
+datamodel: []
 description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. 
   This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website.
   This detection can also catch some normal email communication between organization and its external customer.
diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml
similarity index 87%
rename from tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
rename to tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml
index c3cb0a32c8..bd6e1a260c 100644
--- a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
+++ b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml
@@ -1,7 +1,7 @@
 name: Gsuite Email Suspicious Subject With Attachment Unit Test
 tests:
 - name: Gsuite Email Suspicious Subject With Attachment
-  file: endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+  file: cloud/gsuite_email_suspicious_subject_with_attachment.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml
similarity index 89%
rename from tests/endpoint/gsuite_suspicious_shared_file_name.test.yml
rename to tests/cloud/gsuite_suspicious_shared_file_name.test.yml
index a59374a794..70297baf7d 100644
--- a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml
+++ b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml
@@ -1,7 +1,7 @@
 name: Gsuite Suspicious Shared File Name Unit Test
 tests:
 - name: Gsuite Suspicious Shared File Name
-  file: endpoint/gsuite_suspicious_shared_file_name.yml
+  file: cloud/gsuite_suspicious_shared_file_name.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 5c5146d9fc52b1e55cd1d4de8ae6c3665d772c6f Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 18:42:24 +0200
Subject: [PATCH 07/31] dev_sec2

---
 ...mail_with_known_abuse_web_service_link.yml | 57 +++++++++++++++++++
 ...with_known_abuse_web_service_link.test.yml | 12 ++++
 2 files changed, 69 insertions(+)
 create mode 100644 detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
 create mode 100644 tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
new file mode 100644
index 0000000000..9c9e04c81b
--- /dev/null
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -0,0 +1,57 @@
+name: Gsuite Email With Known Abuse Web Service Link
+id: 8630aa22-042b-11ec-af39-acde48001122
+version: 1
+date: '2021-08-23'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel: []
+description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
+  This event can encounter some normal email traffic within organization and external email that normally using this application and services.
+search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") 
+| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
+  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
+   | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
+  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address src_user subject destination{}.address
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `gsuite_email_with_known_abuse_web_service_link_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file 
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection.
+references:
+- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious email from $source.address$ to $destination{}.address$
+  observable:
+  - name: source.address
+    type: User
+    role:
+    - attacker
+  - name: destination{}.address 
+    type: User
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml
new file mode 100644
index 0000000000..d8161f3f21
--- /dev/null
+++ b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml
@@ -0,0 +1,12 @@
+name: Gsuite Email With Known Abuse Web Service Link Unit Test
+tests:
+- name: Gsuite Email With Known Abuse Web Service Link
+  file: cloud/gsuite_email_with_known_abuse_web_service_link.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: gsuite_susp_url.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
+    source: http:gsuite
+    sourcetype: gsuite:gmail:bigquery
\ No newline at end of file

From 1a51aa26ce528314933cba74e57fd6c07afaa41f Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 18:44:45 +0200
Subject: [PATCH 08/31] dev_sec2

---
 .../cloud/gsuite_email_with_known_abuse_web_service_link.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
index 9c9e04c81b..c1c4f72ba8 100644
--- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -3,7 +3,7 @@ id: 8630aa22-042b-11ec-af39-acde48001122
 version: 1
 date: '2021-08-23'
 author: Teoderick Contreras, Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
   This event can encounter some normal email traffic within organization and external email that normally using this application and services.

From f817aeb64ee9597651ddebc6ca489a313ce06282 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 20:08:35 +0200
Subject: [PATCH 09/31] dev_sec2

---
 .../cloud/gsuite_email_with_known_abuse_web_service_link.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
index c1c4f72ba8..440dbbf50b 100644
--- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -11,7 +11,7 @@ search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*tel
 | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
   | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
    | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address src_user subject destination{}.address
+  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
   | `gsuite_email_with_known_abuse_web_service_link_filter`'

From 4583dd84fb22a59d90e9d11de872ad90392fb3ee Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 26 Aug 2021 12:23:47 +0200
Subject: [PATCH 10/31] dev_sec2

---
 .../cloud/gsuite_email_with_known_abuse_web_service_link.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
index 440dbbf50b..cf0bf78c3a 100644
--- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -5,7 +5,7 @@ date: '2021-08-23'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel: []
-description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
+description: This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
   This event can encounter some normal email traffic within organization and external email that normally using this application and services.
 search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") 
 | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  

From 211a3cd42cd9c1f7c3d1ece4c601c5c02073cf36 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 27 Aug 2021 12:21:48 +0200
Subject: [PATCH 11/31] AD_Discovery_TR-789_4

---
 ...ltdomainpasswordpolicy_with_powershell.yml | 72 +++++++++++++++++++
 ...ordpolicy_with_powershell_script_block.yml | 61 ++++++++++++++++
 ...sultantpasswordpolicy_with_powershell_.yml | 71 ++++++++++++++++++
 ...ordpolicy_with_powershell_script_block.yml | 60 ++++++++++++++++
 .../get_domainpolicy_with_powershell.yml      | 71 ++++++++++++++++++
 ...ainpolicy_with_powershell_script_block.yml | 58 +++++++++++++++
 .../password_policy_discovery_with_net.yml    | 71 ++++++++++++++++++
 ...ainpasswordpolicy_with_powershell.test.yml | 12 ++++
 ...licy_with_powershell_script_block.test.yml | 12 ++++
 ...ntpasswordpolicy_with_powershell_.test.yml | 12 ++++
 ...licy_with_powershell_script_block.test.yml | 12 ++++
 .../get_domainpolicy_with_powershell.test.yml | 12 ++++
 ...licy_with_powershell_script_block.test.yml | 12 ++++
 ...assword_policy_discovery_with_net.test.yml | 12 ++++
 14 files changed, 548 insertions(+)
 create mode 100644 detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
 create mode 100644 detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
 create mode 100644 detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml
 create mode 100644 detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
 create mode 100644 detections/endpoint/get_domainpolicy_with_powershell.yml
 create mode 100644 detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
 create mode 100644 detections/endpoint/password_policy_discovery_with_net.yml
 create mode 100644 tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml
 create mode 100644 tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
 create mode 100644 tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml
 create mode 100644 tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
 create mode 100644 tests/endpoint/get_domainpolicy_with_powershell.test.yml
 create mode 100644 tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
 create mode 100644 tests/endpoint/password_policy_discovery_with_net.test.yml

diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
new file mode 100644
index 0000000000..d20834c34c
--- /dev/null
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
@@ -0,0 +1,72 @@
+name: Get ADDefaultDomainPasswordPolicy with Powershell
+id: 36e46ebe-065a-11ec-b4c7-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. 
+  This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially 
+  in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or 
+  credential dumping as post attack.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*" 
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `get_addefaultdomainpasswordpolicy_with_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: network operator may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 30
+  confidence: 30 
+  # (impact * confidence)/100
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  
\ No newline at end of file
diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
new file mode 100644
index 0000000000..92210f835c
--- /dev/null
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
@@ -0,0 +1,61 @@
+name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block
+id: 1ff7ccc8-065a-11ec-91e4-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. 
+  This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially 
+  in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or 
+  credential dumping as post attack.
+search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. 
+  Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, 
+  or PowerShell Script Block Logging.
+known_false_positives: network operator may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message 
+  - ComputerName 
+  - User
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  # (impact * confidence)/100
+  risk_score: 9
+  context:
+  - source:endpoint
+  - stage:Reconnaissance
+  message: powershell process having commandline $Message$ to query domain password policy 
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml
new file mode 100644
index 0000000000..cf5049d951
--- /dev/null
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml
@@ -0,0 +1,71 @@
+name: Get ADUserResultantPasswordPolicy with Powershell 
+id: 8b5ef342-065a-11ec-b0fc-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. 
+  This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially 
+  in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or 
+  credential dumping as post attack.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*" 
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `get_aduserresultantpasswordpolicy_with_powershell__filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: network operator or admin may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 50
+  confidence: 50 
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
\ No newline at end of file
diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
new file mode 100644
index 0000000000..216df909e3
--- /dev/null
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
@@ -0,0 +1,60 @@
+name: Get ADUserResultantPasswordPolicy with Powershell Script Block
+id: 737e1eb0-065a-11ec-921a-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. 
+  This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially 
+  in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or 
+  credential dumping as post attack.
+search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. 
+  Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, 
+  or PowerShell Script Block Logging.
+known_false_positives: network operator may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message 
+  - ComputerName 
+  - User
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  # (impact * confidence)/100
+  risk_score: 9
+  context:
+  - source:endpoint
+  - stage:Reconnaissance
+  message: powershell process having commandline $Message$ to query domain user password policy.
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml
new file mode 100644
index 0000000000..b29d0088cd
--- /dev/null
+++ b/detections/endpoint/get_domainpolicy_with_powershell.yml
@@ -0,0 +1,71 @@
+name: Get DomainPolicy with Powershell
+id: b8f9947e-065a-11ec-aafb-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. 
+  This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. 
+  This TTP may be a good pivot to look for credential dumping technique or lateral movement.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*" 
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `get_domainpolicy_with_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: network operator or admin may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 50
+  confidence: 60 
+  # (impact * confidence)/100
+  risk_score: 30
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  
\ No newline at end of file
diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
new file mode 100644
index 0000000000..c80f8356f4
--- /dev/null
+++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
@@ -0,0 +1,58 @@
+name: Get DomainPolicy with Powershell Script Block
+id: a360d2b2-065a-11ec-b0bf-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. 
+  This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. 
+  This TTP may be a good pivot to look for credential dumping technique or lateral movement.
+search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. 
+  Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, 
+  or PowerShell Script Block Logging.
+known_false_positives: unknown
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message 
+  - ComputerName 
+  - User
+  security_domain: endpoint
+  impact: 50
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 30
+  context:
+  - source:endpoint
+  - stage:Reconnaissance
+  message: powershell process having commandline $Message$ to query domain policy.
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml
new file mode 100644
index 0000000000..88653cc896
--- /dev/null
+++ b/detections/endpoint/password_policy_discovery_with_net.yml
@@ -0,0 +1,71 @@
+name: Password Policy Discovery with Net
+id: 09336538-065a-11ec-8665-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This search is to detect a net application command to discover password policy. 
+  This commandline can be used by IT and admin to list all account domain policy but also can be use by attacker as part of recon. 
+  this hunting query can be a good pivot to locate credential dumping or lateral movement as part of post attack.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process = "*/domain*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `password_policy_discovery_with_net_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: network operator or admin may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 30
+  confidence: 30 
+  # (impact * confidence)/100
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  
\ No newline at end of file
diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml
new file mode 100644
index 0000000000..b755e420a1
--- /dev/null
+++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml
@@ -0,0 +1,12 @@
+name: Get ADDefaultDomainPasswordPolicy with Powershell Unit Test
+tests:
+- name: Get ADDefaultDomainPasswordPolicy with Powershell
+  file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
+  pass_condition: '| stats count | where count &gt; 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
new file mode 100644
index 0000000000..10993c4630
--- /dev/null
+++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
@@ -0,0 +1,12 @@
+name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block Unit Test
+tests:
+- name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block
+  file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count &gt; 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml
new file mode 100644
index 0000000000..036c1f0f45
--- /dev/null
+++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml
@@ -0,0 +1,12 @@
+name: Get ADUserResultantPasswordPolicy with Powershell  Unit Test
+tests:
+- name: Get ADUserResultantPasswordPolicy with Powershell 
+  file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml
+  pass_condition: '| stats count | where count &gt; 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
new file mode 100644
index 0000000000..f7bd7768d9
--- /dev/null
+++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
@@ -0,0 +1,12 @@
+name: Get ADUserResultantPasswordPolicy with Powershell Script Block Unit Test
+tests:
+- name: Get ADUserResultantPasswordPolicy with Powershell Script Block
+  file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count &gt; 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/get_domainpolicy_with_powershell.test.yml b/tests/endpoint/get_domainpolicy_with_powershell.test.yml
new file mode 100644
index 0000000000..ed86135bf1
--- /dev/null
+++ b/tests/endpoint/get_domainpolicy_with_powershell.test.yml
@@ -0,0 +1,12 @@
+name: Get DomainPolicy with Powershell Unit Test
+tests:
+- name: Get DomainPolicy with Powershell
+  file: endpoint/get_domainpolicy_with_powershell.yml
+  pass_condition: '| stats count | where count &gt; 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
new file mode 100644
index 0000000000..46622ed27d
--- /dev/null
+++ b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
@@ -0,0 +1,12 @@
+name: Get DomainPolicy with Powershell Script Block Unit Test
+tests:
+- name: Get DomainPolicy with Powershell Script Block
+  file: endpoint/get_domainpolicy_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count &gt; 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/password_policy_discovery_with_net.test.yml b/tests/endpoint/password_policy_discovery_with_net.test.yml
new file mode 100644
index 0000000000..5920defe68
--- /dev/null
+++ b/tests/endpoint/password_policy_discovery_with_net.test.yml
@@ -0,0 +1,12 @@
+name: Password Policy Discovery with Net Unit Test
+tests:
+- name: Password Policy Discovery with Net
+  file: endpoint/password_policy_discovery_with_net.yml
+  pass_condition: '| stats count | where count &gt; 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From bc999c36d84d0159a918b8247725b6bcf5c16b13 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 27 Aug 2021 12:24:00 +0200
Subject: [PATCH 12/31] Delete
 gsuite_email_suspicious_subject_with_attachment.yml

---
 ...ail_suspicious_subject_with_attachment.yml | 64 -------------------
 1 file changed, 64 deletions(-)
 delete mode 100644 detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml

diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
deleted file mode 100644
index cba0a58be3..0000000000
--- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
+++ /dev/null
@@ -1,64 +0,0 @@
-name: Gsuite Email Suspicious Subject With Attachment
-id: 8ef3971e-00f2-11ec-b54f-acde48001122
-version: 1
-date: '2021-08-19'
-author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel: []
-description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing.
-  This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment 
-  send from external email account because of the effective social engineering of subject related to delivery, bank and so on.
-  On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc.
-  avoid click link or opening the attachment if you are not expecting this type of e-mail. 
-search: '`gsuite_gmail` num_message_attachments > 0  
-  subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) 
-  attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) 
-  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
-  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
-  | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by   
-  destination{}.service num_message_attachments  subject destination{}.address source.address
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `gsuite_email_suspicious_subject_with_attachment_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file 
-  extension, source email, destination email, num of attachment and etc.
-known_false_positives: normal user or normal transaction may contain the subject and file type attachment that 
-  this detection try to search.
-references:
-- https://www.redhat.com/en/topics/devops/what-is-devsecops
-- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
-tags:
-  analytic_story:
-  - DevSecOps
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1566.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  security_domain: endpoint
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
-  risk_score: 25
-  context:
-  - Source:Endpoint
-  - Stage:Reconnaissance
-  message: suspicious email from $source.address$ to $destination{}.address$
-  observable:
-  - name: source.address
-    type: User
-    role:
-    - attacker
-  - name: destination{}.address 
-    type: User
-    role:
-    - Victim
\ No newline at end of file

From c816c9c98218cfaae3f45c38004cddd1d2f95ada Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 27 Aug 2021 12:24:09 +0200
Subject: [PATCH 13/31] Delete
 gsuite_email_with_known_abuse_web_service_link.yml

---
 ...mail_with_known_abuse_web_service_link.yml | 57 -------------------
 1 file changed, 57 deletions(-)
 delete mode 100644 detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
deleted file mode 100644
index cf0bf78c3a..0000000000
--- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: Gsuite Email With Known Abuse Web Service Link
-id: 8630aa22-042b-11ec-af39-acde48001122
-version: 1
-date: '2021-08-23'
-author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel: []
-description: This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
-  This event can encounter some normal email traffic within organization and external email that normally using this application and services.
-search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") 
-| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
-  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
-   | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `gsuite_email_with_known_abuse_web_service_link_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file 
-  extension, source email, destination email, num of attachment and etc.
-known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection.
-references:
-- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
-tags:
-  analytic_story:
-  - DevSecOps
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1566.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  security_domain: endpoint
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
-  risk_score: 25
-  context:
-  - Source:Endpoint
-  - Stage:Reconnaissance
-  message: suspicious email from $source.address$ to $destination{}.address$
-  observable:
-  - name: source.address
-    type: User
-    role:
-    - attacker
-  - name: destination{}.address 
-    type: User
-    role:
-    - Victim
-  
\ No newline at end of file

From 011092eae917a1fbe2c385bee487ab3056f46c22 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 27 Aug 2021 12:24:22 +0200
Subject: [PATCH 14/31] Delete gsuite_suspicious_shared_file_name.yml

---
 .../gsuite_suspicious_shared_file_name.yml    | 67 -------------------
 1 file changed, 67 deletions(-)
 delete mode 100644 detections/cloud/gsuite_suspicious_shared_file_name.yml

diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml
deleted file mode 100644
index 9b7bd30b24..0000000000
--- a/detections/cloud/gsuite_suspicious_shared_file_name.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-name: Gsuite Suspicious Shared File Name
-id: 07eed200-03f5-11ec-98fb-acde48001122
-version: 1
-date: '2021-08-23'
-author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel: []
-description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. 
-  This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website.
-  This detection can also catch some normal email communication between organization and its external customer.
-search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
-  | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)"  
-  | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)"  
-  | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `gsuite_suspicious_shared_file_name_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file 
-  extension, source email, destination email, num of attachment and etc.
-known_false_positives: normal user or normal transaction may contain the subject and file type attachment that 
-  this detection try to search
-references:
-- https://www.redhat.com/en/topics/devops/what-is-devsecops
-- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
-tags:
-  analytic_story:
-  - DevSecOps
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1566.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - parameters.doc_title
-  - src_domain
-  - dest_domain
-  - email
-  - parameters.visibility
-  - parameters.owner
-  - parameters.doc_type
-  security_domain: endpoint
-  impact: 30
-  confidence: 30
-  # (impact * confidence)/100
-  risk_score: 9
-  context:
-  - Source:Endpoint
-  - Stage:Reconnaissance
-  message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
-  observable:
-  - name: parameters.owner
-    type: User
-    role:
-    - attacker
-  - name: email
-    type: User
-    role:
-    - Victim
-  
\ No newline at end of file

From 41556fc90866eb9e8fda21cad66157ce6f0ff2ae Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 27 Aug 2021 12:24:47 +0200
Subject: [PATCH 15/31] Delete gsuite_suspicious_shared_file_name.test.yml

---
 .../gsuite_suspicious_shared_file_name.test.yml      | 12 ------------
 1 file changed, 12 deletions(-)
 delete mode 100644 tests/cloud/gsuite_suspicious_shared_file_name.test.yml

diff --git a/tests/cloud/gsuite_suspicious_shared_file_name.test.yml b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml
deleted file mode 100644
index 70297baf7d..0000000000
--- a/tests/cloud/gsuite_suspicious_shared_file_name.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Gsuite Suspicious Shared File Name Unit Test
-tests:
-- name: Gsuite Suspicious Shared File Name
-  file: cloud/gsuite_suspicious_shared_file_name.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: gdrive_susp_attach.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
-    source: http:gsuite
-    sourcetype: gsuite:drive:json 
\ No newline at end of file

From a3267549a9f78c7ddc2eb0b82b2453f29ab5f59d Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 27 Aug 2021 12:24:59 +0200
Subject: [PATCH 16/31] Delete
 gsuite_email_with_known_abuse_web_service_link.test.yml

---
 ..._email_with_known_abuse_web_service_link.test.yml | 12 ------------
 1 file changed, 12 deletions(-)
 delete mode 100644 tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml

diff --git a/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml
deleted file mode 100644
index d8161f3f21..0000000000
--- a/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Gsuite Email With Known Abuse Web Service Link Unit Test
-tests:
-- name: Gsuite Email With Known Abuse Web Service Link
-  file: cloud/gsuite_email_with_known_abuse_web_service_link.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: gsuite_susp_url.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
-    source: http:gsuite
-    sourcetype: gsuite:gmail:bigquery
\ No newline at end of file

From 2047227048ef9d8662086fe6895705fd558fb8ef Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 27 Aug 2021 12:25:10 +0200
Subject: [PATCH 17/31] Delete
 gsuite_email_suspicious_subject_with_attachment.test.yml

---
 ...email_suspicious_subject_with_attachment.test.yml | 12 ------------
 1 file changed, 12 deletions(-)
 delete mode 100644 tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml

diff --git a/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml
deleted file mode 100644
index bd6e1a260c..0000000000
--- a/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Gsuite Email Suspicious Subject With Attachment Unit Test
-tests:
-- name: Gsuite Email Suspicious Subject With Attachment
-  file: cloud/gsuite_email_suspicious_subject_with_attachment.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: gsuite_susp_subj_attach.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
-    source: http:gsuite
-    sourcetype: gsuite:gmail:bigquery
\ No newline at end of file

From 7fac82a45ea829b17abcd1912c000015d444439c Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 27 Aug 2021 12:29:15 +0200
Subject: [PATCH 18/31] AD_Discovery_TR-789_4

---
 .../get_domainpolicy_with_powershell_script_block.yml         | 2 +-
 ...et_aduserresultantpasswordpolicy_with_powershell_.test.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
index c80f8356f4..8ae7a3c61f 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
@@ -3,7 +3,7 @@ id: a360d2b2-065a-11ec-b0bf-acde48001122
 version: 1
 date: '2021-08-26'
 author: Teoderick Contreras, Splunk
-type: batch
+type: TTP
 datamodel:
 - Endpoint
 description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. 
diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml
index 036c1f0f45..ff17167b4d 100644
--- a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml
+++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml
@@ -1,7 +1,7 @@
-name: Get ADUserResultantPasswordPolicy with Powershell  Unit Test
+name: Get ADUserResultantPasswordPolicy with Powershell Unit Test
 tests:
 - name: Get ADUserResultantPasswordPolicy with Powershell 
-  file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml
+  file: endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
   pass_condition: '| stats count | where count &gt; 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 4fe608cd8ea6635ac508c1bab1fab948c4cb53bb Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 27 Aug 2021 12:36:57 +0200
Subject: [PATCH 19/31] AD_Discovery_TR-789_4

---
 ... => get_aduserresultantpasswordpolicy_with_powershell.yml} | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename detections/endpoint/{get_aduserresultantpasswordpolicy_with_powershell_.yml => get_aduserresultantpasswordpolicy_with_powershell.yml} (95%)

diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
similarity index 95%
rename from detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml
rename to detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
index cf5049d951..3126b2a12b 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
@@ -1,4 +1,4 @@
-name: Get ADUserResultantPasswordPolicy with Powershell 
+name: Get ADUserResultantPasswordPolicy with Powershell
 id: 8b5ef342-065a-11ec-b0fc-acde48001122
 version: 1
 date: '2021-08-26'
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
-  | `get_aduserresultantpasswordpolicy_with_powershell__filter`'
+  | `get_aduserresultantpasswordpolicy_with_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

From ca0e6f21f78b2a1e26c31ec765ac4be89b96cdca Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Tue, 31 Aug 2021 10:31:08 +0200
Subject: [PATCH 20/31] AD_Discovery_TR-789_4

---
 .../get_addefaultdomainpasswordpolicy_with_powershell.test.yml  | 2 +-
 ...ltdomainpasswordpolicy_with_powershell_script_block.test.yml | 2 +-
 .../get_aduserresultantpasswordpolicy_with_powershell_.test.yml | 2 +-
 ...esultantpasswordpolicy_with_powershell_script_block.test.yml | 2 +-
 tests/endpoint/get_domainpolicy_with_powershell.test.yml        | 2 +-
 .../get_domainpolicy_with_powershell_script_block.test.yml      | 2 +-
 tests/endpoint/password_policy_discovery_with_net.test.yml      | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml
index b755e420a1..40479d3a9a 100644
--- a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml
+++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml
@@ -2,7 +2,7 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell Unit Test
 tests:
 - name: Get ADDefaultDomainPasswordPolicy with Powershell
   file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
-  pass_condition: '| stats count | where count &gt; 0'
+  pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
index 10993c4630..15b4775f0f 100644
--- a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
@@ -2,7 +2,7 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block Unit Test
 tests:
 - name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block
   file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
-  pass_condition: '| stats count | where count &gt; 0'
+  pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml
index ff17167b4d..ace51f6c21 100644
--- a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml
+++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml
@@ -2,7 +2,7 @@ name: Get ADUserResultantPasswordPolicy with Powershell Unit Test
 tests:
 - name: Get ADUserResultantPasswordPolicy with Powershell 
   file: endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
-  pass_condition: '| stats count | where count &gt; 0'
+  pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
index f7bd7768d9..1e9fd7eb85 100644
--- a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
@@ -2,7 +2,7 @@ name: Get ADUserResultantPasswordPolicy with Powershell Script Block Unit Test
 tests:
 - name: Get ADUserResultantPasswordPolicy with Powershell Script Block
   file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
-  pass_condition: '| stats count | where count &gt; 0'
+  pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
diff --git a/tests/endpoint/get_domainpolicy_with_powershell.test.yml b/tests/endpoint/get_domainpolicy_with_powershell.test.yml
index ed86135bf1..f484567632 100644
--- a/tests/endpoint/get_domainpolicy_with_powershell.test.yml
+++ b/tests/endpoint/get_domainpolicy_with_powershell.test.yml
@@ -2,7 +2,7 @@ name: Get DomainPolicy with Powershell Unit Test
 tests:
 - name: Get DomainPolicy with Powershell
   file: endpoint/get_domainpolicy_with_powershell.yml
-  pass_condition: '| stats count | where count &gt; 0'
+  pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
diff --git a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
index 46622ed27d..705eb31b67 100644
--- a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
@@ -2,7 +2,7 @@ name: Get DomainPolicy with Powershell Script Block Unit Test
 tests:
 - name: Get DomainPolicy with Powershell Script Block
   file: endpoint/get_domainpolicy_with_powershell_script_block.yml
-  pass_condition: '| stats count | where count &gt; 0'
+  pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
diff --git a/tests/endpoint/password_policy_discovery_with_net.test.yml b/tests/endpoint/password_policy_discovery_with_net.test.yml
index 5920defe68..7513d219d9 100644
--- a/tests/endpoint/password_policy_discovery_with_net.test.yml
+++ b/tests/endpoint/password_policy_discovery_with_net.test.yml
@@ -2,7 +2,7 @@ name: Password Policy Discovery with Net Unit Test
 tests:
 - name: Password Policy Discovery with Net
   file: endpoint/password_policy_discovery_with_net.yml
-  pass_condition: '| stats count | where count &gt; 0'
+  pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:

From 76a46e2b83a0c941c15b432571e86e29214ab99e Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-156-133>
Date: Tue, 31 Aug 2021 08:49:23 +0000
Subject: [PATCH 21/31] Added detection testing service results inGet
 ADDefaultDomainPasswordPolicy with Powershell

---
 ...ltdomainpasswordpolicy_with_powershell.yml | 38 +++++++++----------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
index d20834c34c..df5a3c6571 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
@@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. 
-  This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially 
-  in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or 
-  credential dumping as post attack.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*" 
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.parent_process_name | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy.
+  This command can be used by attacker to mapped all password policy in a target host.
+  This command may cause some noise especially in admin user that can execute this
+  for policy audit. This hunting query is a good pivot to start investigating possible
+  lateral movement or credential dumping as post attack.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
+  OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_addefaultdomainpasswordpolicy_with_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -39,18 +40,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   - Processes.parent_process_name
   security_domain: endpoint
   impact: 30
-  confidence: 30 
-  # (impact * confidence)/100
+  confidence: 30
   risk_score: 9
   context:
   - Source:Endpoint
@@ -69,4 +69,4 @@ tags:
     type: Parent Process
     role:
     - Parent Process
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 048d9e6e1d8581df8b10670f1a639fc2826b281b Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-151-193>
Date: Tue, 31 Aug 2021 09:12:42 +0000
Subject: [PATCH 22/31] Added detection testing service results inGet
 ADDefaultDomainPasswordPolicy with Powershell Script Block

---
 ...ordpolicy_with_powershell_script_block.yml | 32 +++++++++----------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
index 92210f835c..4493f83d9e 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
@@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. 
-  This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially 
-  in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or 
-  credential dumping as post attack.
-search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy.
+  This command can be used by attacker to mapped all password policy in a target host.
+  This command may cause some noise especially in admin user that can execute this
+  for policy audit. This hunting query is a good pivot to start investigating possible
+  lateral movement or credential dumping as post attack.
+search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`'
-how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. 
-  Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, 
-  or PowerShell Script Block Logging.
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: network operator may use this command
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
@@ -37,18 +37,18 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message 
-  - ComputerName 
+  - Message
+  - ComputerName
   - User
   security_domain: endpoint
   impact: 30
   confidence: 30
-  # (impact * confidence)/100
   risk_score: 9
   context:
   - source:endpoint
   - stage:Reconnaissance
-  message: powershell process having commandline $Message$ to query domain password policy 
+  message: powershell process having commandline $Message$ to query domain password
+    policy
   observable:
   - name: ComputerName
     type: Hostname
@@ -58,4 +58,4 @@ tags:
     type: User
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed

From c1b5706e220e14a2f355a5d490a6bda99b4309df Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-183-33>
Date: Tue, 31 Aug 2021 09:38:54 +0000
Subject: [PATCH 23/31] Added detection testing service results inGet
 ADUserResultantPasswordPolicy with Powershell

---
 ...esultantpasswordpolicy_with_powershell.yml | 39 ++++++++++---------
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
index 3126b2a12b..ad490becb3 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
@@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. 
-  This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially 
-  in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or 
-  credential dumping as post attack.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*" 
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.parent_process_name | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy.
+  This command can be used by attacker to mapped all password policy in a target host.
+  This command may cause some noise especially in admin user that can execute this
+  for policy audit. This hunting query is a good pivot to start investigating possible
+  lateral movement or credential dumping as post attack.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
+  OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_aduserresultantpasswordpolicy_with_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -39,18 +40,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   - Processes.parent_process_name
   security_domain: endpoint
   impact: 50
-  confidence: 50 
-  # (impact * confidence)/100
+  confidence: 50
   risk_score: 25
   context:
   - Source:Endpoint
@@ -68,4 +68,5 @@ tags:
   - name: parent_process_name
     type: Parent Process
     role:
-    - Parent Process
\ No newline at end of file
+    - Parent Process
+  automated_detection_testing: passed

From 4d91dcbe0fd81497c9853e4f9e67fc47cc31effd Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-114-241>
Date: Tue, 31 Aug 2021 10:15:36 +0000
Subject: [PATCH 24/31] Added detection testing service results inGet
 ADUserResultantPasswordPolicy with Powershell Script Block

---
 ...ordpolicy_with_powershell_script_block.yml | 33 ++++++++++---------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
index 216df909e3..6dd5fd9fbb 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
@@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. 
-  This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially 
-  in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or 
-  credential dumping as post attack.
-search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy.
+  This command can be used by attacker to mapped all password policy in a target host.
+  This command may cause some noise especially in admin user that can execute this
+  for policy audit. This hunting query is a good pivot to start investigating possible
+  lateral movement or credential dumping as post attack.
+search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`'
-how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. 
-  Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, 
-  or PowerShell Script Block Logging.
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: network operator may use this command
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
@@ -37,18 +37,18 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message 
-  - ComputerName 
+  - Message
+  - ComputerName
   - User
   security_domain: endpoint
   impact: 30
   confidence: 30
-  # (impact * confidence)/100
   risk_score: 9
   context:
   - source:endpoint
   - stage:Reconnaissance
-  message: powershell process having commandline $Message$ to query domain user password policy.
+  message: powershell process having commandline $Message$ to query domain user password
+    policy.
   observable:
   - name: ComputerName
     type: Hostname
@@ -57,4 +57,5 @@ tags:
   - name: User
     type: User
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 4d4ed72a51a223cbb9f2ef7bd159d27cb82c1d13 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-123-40>
Date: Tue, 31 Aug 2021 10:37:41 +0000
Subject: [PATCH 25/31] Added detection testing service results inGet
 DomainPolicy with Powershell

---
 .../get_domainpolicy_with_powershell.yml      | 36 +++++++++----------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml
index b29d0088cd..133acaf599 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell.yml
@@ -6,15 +6,16 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. 
-  This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. 
-  This TTP may be a good pivot to look for credential dumping technique or lateral movement.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*" 
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.parent_process_name | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+description: This search is to detect a possible execution of powerview pentesting
+  tool for domain controller recon. This search look for function Get-DomainPolicy
+  to parse the domain policy of the targeted host. This TTP may be a good pivot to
+  look for credential dumping technique or lateral movement.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
+  OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_domainpolicy_with_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -38,18 +39,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   - Processes.parent_process_name
   security_domain: endpoint
   impact: 50
-  confidence: 60 
-  # (impact * confidence)/100
+  confidence: 60
   risk_score: 30
   context:
   - Source:Endpoint
@@ -68,4 +68,4 @@ tags:
     type: Parent Process
     role:
     - Parent Process
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 4ecb10aff70afb67cf762cbc77dcdf5da1a173e8 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-20-136>
Date: Tue, 31 Aug 2021 11:43:10 +0000
Subject: [PATCH 26/31] Added detection testing service results inGet
 DomainPolicy with Powershell Script Block

---
 ...ainpolicy_with_powershell_script_block.yml | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
index 8ae7a3c61f..f0f5889b81 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
@@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. 
-  This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. 
-  This TTP may be a good pivot to look for credential dumping technique or lateral movement.
-search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
-  | `security_content_ctime(firstTime)`
+description: This search is to detect a possible execution of powerview pentesting
+  tool for domain controller recon. This search look for function Get-DomainPolicy
+  to parse the domain policy of the targeted host. This TTP may be a good pivot to
+  look for credential dumping technique or lateral movement.
+search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`'
-how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. 
-  Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, 
-  or PowerShell Script Block Logging.
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: unknown
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
@@ -35,13 +35,12 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message 
-  - ComputerName 
+  - Message
+  - ComputerName
   - User
   security_domain: endpoint
   impact: 50
   confidence: 60
-  # (impact * confidence)/100
   risk_score: 30
   context:
   - source:endpoint
@@ -55,4 +54,5 @@ tags:
   - name: User
     type: User
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 84bf0e3ec2a19e5c78e2c4c1700d705f886609a8 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-221-233>
Date: Tue, 31 Aug 2021 13:48:54 +0000
Subject: [PATCH 27/31] Added detection testing service results inPassword
 Policy Discovery with Net

---
 .../password_policy_discovery_with_net.yml    | 37 ++++++++++---------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml
index 88653cc896..0ba6d0f025 100644
--- a/detections/endpoint/password_policy_discovery_with_net.yml
+++ b/detections/endpoint/password_policy_discovery_with_net.yml
@@ -6,15 +6,17 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This search is to detect a net application command to discover password policy. 
-  This commandline can be used by IT and admin to list all account domain policy but also can be use by attacker as part of recon. 
-  this hunting query can be a good pivot to locate credential dumping or lateral movement as part of post attack.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process = "*/domain*"
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.parent_process_name | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+description: This search is to detect a net application command to discover password
+  policy. This commandline can be used by IT and admin to list all account domain
+  policy but also can be use by attacker as part of recon. this hunting query can
+  be a good pivot to locate credential dumping or lateral movement as part of post
+  attack.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
+  OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process
+  = "*/domain*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `password_policy_discovery_with_net_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -38,18 +40,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   - Processes.parent_process_name
   security_domain: endpoint
   impact: 30
-  confidence: 30 
-  # (impact * confidence)/100
+  confidence: 30
   risk_score: 9
   context:
   - Source:Endpoint
@@ -68,4 +69,4 @@ tags:
     type: Parent Process
     role:
     - Parent Process
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 476df2188dd5fa42b5119b2a830a525b06afe440 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 2 Sep 2021 23:38:37 +0000
Subject: [PATCH 28/31] Bump mysql-connector-python from 8.0.25 to 8.0.26

Bumps [mysql-connector-python](http://dev.mysql.com/doc/connector-python/en/index.html) from 8.0.25 to 8.0.26.

---
updated-dependencies:
- dependency-name: mysql-connector-python
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 5182fa1312..f4f9e9af56 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -38,7 +38,7 @@ MarkupSafe==2.0.1
 mock==4.0.3
 more-itertools==8.7.0
 nodeenv==1.6.0
-mysql-connector-python==8.0.25
+mysql-connector-python==8.0.26
 ntlm-auth==1.5.0
 packaging==21.0
 path==15.1.2

From d7759b6dfcc53a84ea2bbc130e3d09526a3c5339 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 2 Sep 2021 16:56:29 -0700
Subject: [PATCH 29/31] Update
 get_addefaultdomainpasswordpolicy_with_powershell.yml

---
 .../get_addefaultdomainpasswordpolicy_with_powershell.yml        | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
index df5a3c6571..3c7fd85f4c 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
@@ -70,3 +70,4 @@ tags:
     role:
     - Parent Process
   automated_detection_testing: passed
+  

From dfc59d01b47b90df0e7af962bba2cd50ff73735e Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Fri, 3 Sep 2021 11:34:00 -0700
Subject: [PATCH 30/31] Update requirements.txt

---
 automated_detection_testing/requirements.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index f4f9e9af56..204eeb14aa 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -79,3 +79,4 @@ wget==3.2
 wrapt==1.12.1
 xmltodict==0.12.0
 zipp==3.4.1
+

From 02828a0d949c79357a253bc3399efdcadb508338 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Fri, 3 Sep 2021 11:43:23 -0700
Subject: [PATCH 31/31] testing auto-approve

---
 .github/workflows/auto-approve.yml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index c149be16e8..ea7cb9209f 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -1,11 +1,15 @@
-name: auto-approve
-on: pull_request
+name: Auto approve PRs by dependabot
+
+# Trigger the workflow on pull request
+on: pull_request_target
 
 jobs:
-  build:
+  autoapprove:
+    name: Auto-Approve a PR by dependabot
     runs-on: ubuntu-latest
     steps:
-    - uses: hmarr/auto-approve-action@v2.0.0
-      if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]'
-      with:
-        github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Auto approve
+        uses: cognitedata/auto-approve-dependabot-action@v3.0.1
+        if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]'
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file