Branch was auto-updated.

detections/endpoint/windows_remote_create_service.yml

@@ -5,7 +5,6 @@ date: '2023-03-20'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-status: production
 data_source:
 - Sysmon Event ID 1
 description: This analytic identifies an endpoint that remotely connects to another endpoint to create a new service using sc.exe. On the remote endpoint, the new service will be created and this action will trigger the creation of EventCode 7045 along with all the resulting service information.

dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml

@@ -0,0 +1,76 @@
+name: Windows Lateral Tool Transfer RemCom
+id: 25c6b8ba-2a61-41ad-b80c-8e97cf501920
+version: 1
+date: '2022-02-23'
+author: Michael Haag, Splunk
+status: experimental
+type: TTP
+description: This analytic identifies the use of RemCom.exe - The open source psexec. This utility provides the ability to move laterally and run scripts or commands remotely.
+data_source:
+- Windows Security 4688
+search:
+  selection1:
+    process.cmd_line|contains:
+    - '/user:'
+    - '/pwd:'
+    - '\\'
+    process.file.name: remcom.exe
+  condition: (selection1)
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: It is possible legitimate applications may perform this behavior
+  and will need to be filtered.
+references:
+  - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
+  - https://github.com/kavika13/RemCom
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  - Living Off The Land
+  asset_type: Endpoint
+  confidence: 50
+  impact: 80
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to move laterally.
+  mitre_attack_id:
+  - T1570
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  kill_chain_phases:
+  - Exploitation
+  risk_score: 40
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/4688_remcom_windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml

@@ -0,0 +1,64 @@
+name: Windows PowerShell Export Certificate
+id: 0bf87e10-4d7d-4c63-9721-c7b3f6e6e944
+version: 1
+date: '2023-05-01'
+author: Michael Haag, Splunk
+status: experimental
+type: Anomaly
+description: The following analytic identifies the PowerShell Cmdlet export-certificate
+  utilizing Script Block Logging. This particular behavior is related to an adversary
+  attempting to steal certificates local to the Windows endpoint within the Certificate
+  Store.
+data_source:
+- Powershell 4104
+search:
+  selection1:
+    process.cmd_line|re: 'export-certificate'
+  condition: (selection1)
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands,
+  filtering may be required.
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  confidence: 60
+  impact: 60
+  message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$,
+    attempting to export a certificate.
+  mitre_attack_id:
+  - T1552.004
+  - T1552
+  - T1649
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - process
+  kill_chain_phases:
+  - Exploitation
+  risk_score: 36
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml

@@ -0,0 +1,64 @@
+name: Windows PowerShell Export PFXCertificate
+id: 0c93bb7a-df21-477e-a623-b0c37c1c6661
+version: 1
+date: '2023-05-18'
+author: Michael Haag, Splunk
+status: experimental
+type: anomaly
+description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate
+  utilizing Script Block Logging. This particular behavior is related to an adversary
+  attempting to steal certificates local to the Windows endpoint within the Certificate
+  Store.
+data_source:
+- Powershell 4104
+search:
+  selection1:
+    process.cmd_line|re: 'export-pfxcertificate'
+  condition: (selection1)
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands,
+  filtering may be required.
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  confidence: 60
+  impact: 60
+  message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$,
+    attempting to export a pfxcertificate.
+  mitre_attack_id:
+  - T1552.004
+  - T1552
+  - T1649
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - process
+  kill_chain_phases:
+  - Exploitation
+  risk_score: 36
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfx-windows-powershell.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

dev_ssa/endpoint/ssa___windows_remote_create_service.yml

@@ -0,0 +1,69 @@
+name: Windows Remote Create Service
+id: 0259ff91-a6f3-4af1-af83-6360eff7fd80
+version: 1
+date: '2023-05-18'
+author: Michael Haag, Splunk
+status: experimental
+type: TTP
+description: 'This analytic identifies an endpoint that remotely connects to another endpoint to create a new service using sc.exe. On the remote endpoint, the new service will be created and this action will trigger the creation of EventCode 7045 along with all the resulting service information.'
+data_source:
+- Windows Security 4688
+search:
+  selection1:
+    process.cmd_line|re:
+    - 'create'
+    - '\\\\'
+    process.file.name: sc.exe
+  condition: (selection1)
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities.
+references:
+  - https://attack.mitre.org/techniques/T1543/003/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a remote service.
+  mitre_attack_id:
+  - T1543
+  - T1543.003
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  kill_chain_phases:
+  - Exploitation
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/4688-remote-service-create-windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml

@@ -0,0 +1,70 @@
+name: Windows Service Create with TSCon
+id: 6d16f079-0195-4fdc-a97d-7cfacb6b9b4d
+version: 1
+date: '2022-02-23'
+author: Michael Haag, Splunk
+status: experimental
+type: TTP
+description: 'The following analytic detects potential RDP Hijacking attempts by monitoring a series of actions taken by an attacker to gain unauthorized access to a remote system. The attacker first runs the quser command to query the remote host for disconnected user sessions. Upon identifying a disconnected session, they use the sc.exe command to create a new Windows service with a binary path that launches tscon.exe. By specifying the disconnected session ID and a destination ID, the attacker can transfer the disconnected session to a new RDP session, effectively hijacking the user''s session. This analytic allows security teams to detect and respond to RDP Hijacking attempts, mitigating potential risks and impacts on targeted systems.'
+data_source:
+- Windows Security 4688
+search:
+  selection1:
+    process.cmd_line|re:
+    - '/dest:rdp-tcp'
+    process.file.name: sc.exe
+  condition: (selection1)
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may arise in the RDP Hijacking analytic when legitimate administrators access remote sessions for maintenance or troubleshooting purposes. These activities might resemble an attacker''s attempt to hijack a disconnected session, leading to false alarms. To mitigate the risk of false positives and improve the overall security posture, organizations can implement Group Policy to automatically disconnect RDP sessions when they are complete. By enforcing this policy, administrators ensure that disconnected sessions are promptly terminated, reducing the window of opportunity for an attacker to hijack a session. Additionally, organizations can also implement access control mechanisms and monitor the behavior of privileged accounts to further enhance security and reduce the chances of false positives in RDP Hijacking detection.
+references:
+  - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  asset_type: Endpoint
+  confidence: 50
+  impact: 80
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to hijack a RDP session.
+  mitre_attack_id:
+  - T1563.002
+  - T1563
+  - T1543.003
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  kill_chain_phases:
+  - Exploitation
+  risk_score: 40
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/4688_tscon_windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml

@@ -0,0 +1,110 @@
+name: Windows Lateral Tool Transfer RemCom
+id: 25c6b8ba-2a61-41ad-b80c-8e97cf501920
+version: 1
+date: '2022-02-23'
+author: Michael Haag, Splunk
+type: TTP
+status: experimental
+description: This analytic identifies the use of RemCom.exe - The open source psexec.
+  This utility provides the ability to move laterally and run scripts or commands
+  remotely.
+data_source:
+- Windows Security 4688
+search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
+  null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
+  null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
+  process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
+  "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (like(process_cmd_line, "%/user:%") OR like(process_cmd_line, "%/pwd:%")
+  OR like(process_cmd_line, "%\\%")) AND process_file_name="remcom.exe" --finding_report--'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: It is possible legitimate applications may perform this behavior
+  and will need to be filtered.
+references:
+- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
+- https://github.com/kavika13/RemCom
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  - Living Off The Land
+  asset_type: Endpoint
+  confidence: 50
+  impact: 80
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to move laterally.
+  mitre_attack_id:
+  - T1570
+  observable:
+  - name: process.pid
+    type: Other
+  - name: process.file.path
+    type: File
+  - name: process.file.name
+    type: File
+  - name: process.cmd_line
+    type: Other
+  - name: actor.user.name
+    type: User Name
+  - name: actor.process.pid
+    type: Other
+  - name: actor.process.file.path
+    type: File Name
+  - name: actor.process.file.name
+    type: File Name
+  - name: device.hostname
+    type: Hostname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process.pid
+  - process.file.path
+  - process.file.name
+  - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
+  risk_score: 40
+  security_domain: endpoint
+  mappings:
+  - ocsf: process.pid
+    cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
+  - ocsf: process.file.name
+    cim: process_name
+  - ocsf: process.cmd_line
+    cim: process
+  - ocsf: actor.user.name
+    cim: user
+  - ocsf: actor.process.pid
+    cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
+  - ocsf: actor.process.file.name
+    cim: parent_process_name
+  - ocsf: device.hostname
+    cim: dest
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/4688_remcom_windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog

ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml

@@ -0,0 +1,83 @@
+name: Windows PowerShell Export Certificate
+id: 0bf87e10-4d7d-4c63-9721-c7b3f6e6e944
+version: 1
+date: '2023-05-01'
+author: Michael Haag, Splunk
+type: Anomaly
+status: experimental
+description: The following analytic identifies the PowerShell Cmdlet export-certificate
+  utilizing Script Block Logging. This particular behavior is related to an adversary
+  attempting to steal certificates local to the Windows endpoint within the Certificate
+  Store.
+data_source:
+- Powershell 4104
+search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
+  null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
+  null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
+  device=ucast(map_get(input_event,"device"), "map<string, any>", null) | eval device_hostname=ucast(map_get(device,"hostname"),
+  "string", null) | eval process=ucast(map_get(input_event,"process"), "map<string,
+  any>", null) | eval process_file=ucast(map_get(process,"file"), "map<string, any>",
+  null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null)
+  | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_user=ucast(map_get(actor,"user"), "map<string, any>", null) |
+  eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line,
+  /(?i)export-certificate/)=true --finding_report--'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands,
+  filtering may be required.
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  confidence: 60
+  impact: 60
+  message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$,
+    attempting to export a certificate.
+  mitre_attack_id:
+  - T1552.004
+  - T1552
+  - T1649
+  observable:
+  - name: device.hostname
+    type: Hostname
+  - name: process.file.path
+    type: File
+  - name: process.uid
+    type: Other
+  - name: process.cmd_line
+    type: Other
+  - name: actor.user.uid
+    type: Other
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - device.hostname
+  - process.file.path
+  - process.uid
+  - process.cmd_line
+  - actor.user.uid
+  risk_score: 36
+  security_domain: endpoint
+  mappings:
+  - ocsf: device.hostname
+    cim: dest
+  - ocsf: process.file.path
+    cim: process_path
+  - ocsf: process.uid
+    cim: process_id
+  - ocsf: process.cmd_line
+    cim: process
+  - ocsf: actor.user.uid
+    cim: user_id
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog

ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml

@@ -0,0 +1,83 @@
+name: Windows PowerShell Export PFXCertificate
+id: 0c93bb7a-df21-477e-a623-b0c37c1c6661
+version: 1
+date: '2023-05-18'
+author: Michael Haag, Splunk
+type: anomaly
+status: experimental
+description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate
+  utilizing Script Block Logging. This particular behavior is related to an adversary
+  attempting to steal certificates local to the Windows endpoint within the Certificate
+  Store.
+data_source:
+- Powershell 4104
+search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
+  null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
+  null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
+  device=ucast(map_get(input_event,"device"), "map<string, any>", null) | eval device_hostname=ucast(map_get(device,"hostname"),
+  "string", null) | eval process=ucast(map_get(input_event,"process"), "map<string,
+  any>", null) | eval process_file=ucast(map_get(process,"file"), "map<string, any>",
+  null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null)
+  | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_user=ucast(map_get(actor,"user"), "map<string, any>", null) |
+  eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line,
+  /(?i)export-pfxcertificate/)=true --finding_report--'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands,
+  filtering may be required.
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  confidence: 60
+  impact: 60
+  message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$,
+    attempting to export a pfxcertificate.
+  mitre_attack_id:
+  - T1552.004
+  - T1552
+  - T1649
+  observable:
+  - name: device.hostname
+    type: Hostname
+  - name: process.file.path
+    type: File
+  - name: process.uid
+    type: Other
+  - name: process.cmd_line
+    type: Other
+  - name: actor.user.uid
+    type: Other
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - device.hostname
+  - process.file.path
+  - process.uid
+  - process.cmd_line
+  - actor.user.uid
+  risk_score: 36
+  security_domain: endpoint
+  mappings:
+  - ocsf: device.hostname
+    cim: dest
+  - ocsf: process.file.path
+    cim: process_path
+  - ocsf: process.uid
+    cim: process_id
+  - ocsf: process.cmd_line
+    cim: process
+  - ocsf: actor.user.uid
+    cim: user_id
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfx-windows-powershell.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog

ssa_detections/endpoint/ssa___windows_remote_create_service.yml

@@ -0,0 +1,112 @@
+name: Windows Remote Create Service
+id: 0259ff91-a6f3-4af1-af83-6360eff7fd80
+version: 1
+date: '2023-05-18'
+author: Michael Haag, Splunk
+type: TTP
+status: experimental
+description: This analytic identifies an endpoint that remotely connects to another
+  endpoint to create a new service using sc.exe. On the remote endpoint, the new service
+  will be created and this action will trigger the creation of EventCode 7045 along
+  with all the resulting service information.
+data_source:
+- Windows Security 4688
+search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
+  null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
+  null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
+  process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
+  "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (match_regex(process_cmd_line, /(?i)create/)=true OR match_regex(process_cmd_line,
+  /(?i)\\\\/)=true) AND process_file_name="sc.exe" --finding_report--'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Note that false positives may occur, and filtering may be necessary,
+  especially when it comes to remote service creation by administrators or software
+  management utilities.
+references:
+- https://attack.mitre.org/techniques/T1543/003/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a remote
+    service.
+  mitre_attack_id:
+  - T1543
+  - T1543.003
+  observable:
+  - name: process.pid
+    type: Other
+  - name: process.file.path
+    type: File
+  - name: process.file.name
+    type: File
+  - name: process.cmd_line
+    type: Other
+  - name: actor.user.name
+    type: User Name
+  - name: actor.process.pid
+    type: Other
+  - name: actor.process.file.path
+    type: File Name
+  - name: actor.process.file.name
+    type: File Name
+  - name: device.hostname
+    type: Hostname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process.pid
+  - process.file.path
+  - process.file.name
+  - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
+  risk_score: 25
+  security_domain: endpoint
+  mappings:
+  - ocsf: process.pid
+    cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
+  - ocsf: process.file.name
+    cim: process_name
+  - ocsf: process.cmd_line
+    cim: process
+  - ocsf: actor.user.name
+    cim: user
+  - ocsf: actor.process.pid
+    cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
+  - ocsf: actor.process.file.name
+    cim: parent_process_name
+  - ocsf: device.hostname
+    cim: dest
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/4688-remote-service-create-windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog

ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml

@@ -0,0 +1,126 @@
+name: Windows Service Create with TSCon
+id: 6d16f079-0195-4fdc-a97d-7cfacb6b9b4d
+version: 1
+date: '2022-02-23'
+author: Michael Haag, Splunk
+type: TTP
+status: experimental
+description: The following analytic detects potential RDP Hijacking attempts by monitoring
+  a series of actions taken by an attacker to gain unauthorized access to a remote
+  system. The attacker first runs the quser command to query the remote host for disconnected
+  user sessions. Upon identifying a disconnected session, they use the sc.exe command
+  to create a new Windows service with a binary path that launches tscon.exe. By specifying
+  the disconnected session ID and a destination ID, the attacker can transfer the
+  disconnected session to a new RDP session, effectively hijacking the user's session.
+  This analytic allows security teams to detect and respond to RDP Hijacking attempts,
+  mitigating potential risks and impacts on targeted systems.
+data_source:
+- Windows Security 4688
+search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
+  null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
+  null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
+  process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
+  "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%/dest:rdp-tcp%") --finding_report--'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may arise in the RDP Hijacking analytic when
+  legitimate administrators access remote sessions for maintenance or troubleshooting
+  purposes. These activities might resemble an attacker''s attempt to hijack a disconnected
+  session, leading to false alarms. To mitigate the risk of false positives and improve
+  the overall security posture, organizations can implement Group Policy to automatically
+  disconnect RDP sessions when they are complete. By enforcing this policy, administrators
+  ensure that disconnected sessions are promptly terminated, reducing the window of
+  opportunity for an attacker to hijack a session. Additionally, organizations can
+  also implement access control mechanisms and monitor the behavior of privileged
+  accounts to further enhance security and reduce the chances of false positives in
+  RDP Hijacking detection.
+references:
+- https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  asset_type: Endpoint
+  confidence: 50
+  impact: 80
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to hijack a RDP
+    session.
+  mitre_attack_id:
+  - T1563.002
+  - T1563
+  - T1543.003
+  observable:
+  - name: process.pid
+    type: Other
+  - name: process.file.path
+    type: File
+  - name: process.file.name
+    type: File
+  - name: process.cmd_line
+    type: Other
+  - name: actor.user.name
+    type: User Name
+  - name: actor.process.pid
+    type: Other
+  - name: actor.process.file.path
+    type: File Name
+  - name: actor.process.file.name
+    type: File Name
+  - name: device.hostname
+    type: Hostname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process.pid
+  - process.file.path
+  - process.file.name
+  - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
+  risk_score: 40
+  security_domain: endpoint
+  mappings:
+  - ocsf: process.pid
+    cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
+  - ocsf: process.file.name
+    cim: process_name
+  - ocsf: process.cmd_line
+    cim: process
+  - ocsf: actor.user.name
+    cim: user
+  - ocsf: actor.process.pid
+    cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
+  - ocsf: actor.process.file.name
+    cim: parent_process_name
+  - ocsf: device.hostname
+    cim: dest
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/4688_tscon_windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog