Drop comments to get search working, change file name to reflect generic case of detecting any type of share deletion or creation.

detections/create_hidden_shares.yml

@@ -1,112 +0,0 @@
-asset_type: Endpoint
-confidence: medium
-creation_date: '2018-06-14'
-data_metadata:
-  data_models:
-    - Endpoint
-  data_source:
-    - Endpoint Intel
-  providing_technologies:
-    - Carbon Black Response
-    - CrowdStrike Falcon
-    - Sysmon
-    - Tanium
-    - Ziften
-description: This search looks for the creation or deletion of hidden shares using
-  net.exe.
-detect:
-  splunk:
-    correlation_rule:
-      notable:
-        nes_fields: dest,process_name
-        rule_description: Net.exe was used to create or delete hidden network shares
-          by $user$ on $dest$
-        rule_title: Hidden File shares created/deleted on $dest$
-      risk:
-        risk_object: dest
-        risk_object_type:
-          - system
-        risk_score: 50
-      macros:
-        - create_hidden_shares_filter
-      schedule:
-        cron_schedule: 5 * * * *
-        earliest_time: -70m@m
-        latest_time: -10m@m
-      search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process)
-        as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-        where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by
-        Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)`
-        | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search (process=*share* OR process=*delete*)|
-        regex process="\S+[$]" | `create_hidden_shares_filter`'
-      suppress:
-        suppress_fields: dest,process_name
-        suppress_period: 86400s
-eli5: Net.exe is a built-in command-line tool on Windows that can be used to create,
-  delete, and manage shared resources on the computer, both locally and remotely.
-  Though this tool is used by Microsoft administrators to manage the network shares,
-  attackers also leverage it to create and delete hidden file shares by appending
-  "$" after the name of the share. To look for hidden shares, use a regular expression
-  to look for a `(name_file_share)$`. In this search, we are looking for the command-line
-  execution of net.exe with command-line parameters such as `net`, `share`, or `delete`
-  that may correspond to the creation of hidden shares
-entities:
-  - dest
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-id: qw9919ed-fe5f-492c-b139-151bb162140e
-investigations:
-  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
-    name: Get Authentication Logs For Endpoint
-    type: splunk
-  - id: fecf2918-670d-4f1c-872b-3d7317a41bf9
-    name: Get Parent Process Info
-    type: splunk
-  - id: fdcfb369-1725-4c24-824a-22972d7f0d55
-    name: Get Risk Modifiers For User
-    type: splunk
-  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
-    name: Get Process Info
-    type: splunk
-  - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
-    name: Get Notable History
-    type: splunk
-  - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
-    name: Get Notable Info
-    type: splunk
-  - id: fdcfb369-1725-4c24-824a-22972d7f0d65
-    name: Get Risk Modifiers For Endpoint
-    type: splunk
-  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
-    name: Get User Information from Identity Table
-    type: splunk
-known_false_positives: Administrators often leverage net.exe to create or delete network
-  shares. You should verify that the activity was intentional and is legitimate.
-maintainers:
-  - company: Splunk
-    email: bpatel@splunk.com
-    name: Bhavin Patel
-mappings:
-  cis20:
-    - CIS 8
-  kill_chain_phases:
-    - Actions on Objectives
-  mitre_attack:
-    - Lateral Movement
-  nist:
-    - PR.PT
-    - DE.CM
-modification_date: '2020-01-09'
-name: Create or delete hidden shares using net.exe
-original_authors:
-  - company: Splunk
-    email: bpatel@splunk.com
-    name: Bhavin Patel
-references: []
-security_domain: endpoint
-spec_version: 2
-type: splunk
-version: '4.0'

detections/create_or_delete_network_shares.yml

@@ -33,11 +33,10 @@ detect:
         cron_schedule: 5 * * * *
         earliest_time: -70m@m
         latest_time: -10m@m
-      search: '| `comment("GET WINDOWS EVENT LOGS THAT CAN CONTAIN NETWORK SHARE OPERATION INFO OVER DATE RANGE")`
-      tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process)
+      search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process)
         as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
         where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by
-        Processes.process Processes.process_name Processes.dest | `comment("CLEAN UP OUTPUT, SEARCH ON KEYWORDS RELATED TO CREATE/DELETE EVENTS")`
+        Processes.process Processes.process_name Processes.dest
         | `drop_dm_object_name(Processes)`
         | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search (process=*share* OR process=*delete*)
         | `comment`("UNCOMMENT THIS REGEX TO SEARCH FOR ONLY EVENTS RELATED TO HIDDEN SHARES: regex process="\S+[$]")`
@@ -53,9 +52,8 @@ eli5: In this search, we are looking for the command-line execution of net.exe w
   attackers also leverage it to create and delete (hidden) file shares by appending
   "$" after the name of the share. Since the creation/deletion of hidden shares is a
   special case of detecting share creation/deletion we have commented out
-  the regex that adds the additional matching criteria that will return only events that
-  have creation/deletion associated to hidden shares. To look for hidden shares, use a
-  regular expression to look for a `(name_file_share)$`.
+  the regex that adds that additional matching criteria. If only hidden share detection is desired
+  add `| regex process="\S+[$]"` before the last pipe in the search.
 entities:
   - dest
 how_to_implement: You must be ingesting data that records process activity from your