Update suspicious_microsoft_workflow_compiler_usage.yml

detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml

@@ -1,6 +1,6 @@
 name: Suspicious microsoft workflow compiler usage
 id: 9bbc62e8-55d8-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-12'
 author: Michael Haag, Splunk
 type: batch
@@ -12,8 +12,8 @@ description: The following analytic identifies microsoft.workflow.compiler.exe u
   review. It is not a commonly used process by many applications.
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=microsoft.workflow.compiler.exe
-  by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=microsoft.workflow.compiler.exe OR Processes.process_name=microsoft.workflow.compiler.exe)
+  by Processes.dest Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -34,8 +34,6 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  - Stage:Execution
-  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
   impact: 70
@@ -62,10 +60,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
-  - Processes.parent_process
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint