From 38cd9baaef4b2d2df72bb65a43dd2f252a1d8c8a Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 18 Jul 2022 09:44:25 -0500
Subject: [PATCH 1/5] Removed mpcmdrun.exe

---
 .../ssa___windows_lolbin_binary_in_non_standard_path.yml     | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 44f29b9c6c..0f3dd5e707 100644
--- a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -19,8 +19,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
   process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
   process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
-  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe" OR 
-  process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
+  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
   process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
   process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
   process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
@@ -29,7 +28,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND 
   match_regex(process_path, /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
   AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path, /(?i)\\winsxs/)=false
-  AND match_regex(process_path, /(?i)\\microsoft.net/)=false AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false | eval start_time=timestamp,
+  AND match_regex(process_path, /(?i)\\microsoft.net/)=false | eval start_time=timestamp,
   end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
   event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.

From f52137cb8f2f060c1eed45e7d80e9fd970699209 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Tue, 19 Jul 2022 08:53:04 -0500
Subject: [PATCH 2/5] new mpcmdrun detection

---
 ...ws_defender_tools_in_non_standard_path.yml | 66 +++++++++++++++++++
 ...fender_tools_in_non_standard_path.test.yml | 13 ++++
 2 files changed, 79 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
 create mode 100644 tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml

diff --git a/detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
new file mode 100644
index 0000000000..910f541343
--- /dev/null
+++ b/detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
@@ -0,0 +1,66 @@
+name: Windows Defender Tools in Non Standard Path
+id: c205bd2e-cd5b-4224-8510-578a2a1f83d7
+version: 1
+date: '2022-07-18'
+author: Lou Stella, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies usage of the MPCmdRun utility that can be abused by adversaries by moving it to a new directory. 
+search: ' from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
+  "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
+  "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
+  null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
+  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name IS NOT NULL AND process_name="mpcmdrun.exe" | where process_path IS NOT NULL AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false AND match_regex(process_path, /(?i)\\windows defender/)=false | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
+  event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events(); '
+how_to_implement: Collect endpoint data such as sysmon or 4688 events.
+known_false_positives: False positives may be present and filtering may be required.
+references:
+- https://attack.mitre.org/techniques/T1036/003/
+- https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Process $process_name$ with commandline $cmd_line$ spawn in non-default folder path on host $dest_device_id$
+  mitre_attack_id:
+  - T1036
+  - T1036.003
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  risk_severity: medium
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - process_name
+  - _time
+  - dest_user_id
+  - process_path
+  - cmd_line  
+  risk_score: 56
+  security_domain: endpoint
diff --git a/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml b/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
new file mode 100644
index 0000000000..58e9d7a3ed
--- /dev/null
+++ b/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
@@ -0,0 +1,13 @@
+name: Windows Defender Tools in Non Standard Path Unit Test
+tests:
+- name: Windows Defender Tools in Non Standard Path
+  file: endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

From 2ca7679c841eb65ef7204e1839696b3f90347255 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Tue, 19 Jul 2022 09:05:19 -0500
Subject: [PATCH 3/5] Fixed missing paren, sourcetype

---
 .../ssa___windows_defender_tools_in_non_standard_path.yml   | 6 +++---
 ...a___windows_defender_tools_in_non_standard_path.test.yml | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
index 910f541343..96ce48f223 100644
--- a/detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
+++ b/detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
@@ -10,11 +10,11 @@ description: The following analytic identifies usage of the MPCmdRun utility tha
 search: ' from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
   "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
   "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
-  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
-  null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
+  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", 
+  null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name IS NOT NULL AND process_name="mpcmdrun.exe" | where process_path IS NOT NULL AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false AND match_regex(process_path, /(?i)\\windows defender/)=false | eval start_time=timestamp,
   end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
-  event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events(); '
+  event_id, "process_path", process_path, "process_name", process_name, "cmd_line", cmd_line]) | into write_ssa_detected_events(); '
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: False positives may be present and filtering may be required.
 references:
diff --git a/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml b/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
index 58e9d7a3ed..0a273e259c 100644
--- a/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
+++ b/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
@@ -8,6 +8,6 @@ tests:
   attack_data:
   - file_name: UPDATE
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log
-    source: XmlWinEventLog:Security
+    source: XmlWinEventLog
     sourcetype: XmlWinEventLog
     update_timestamp: true

From 92d515e50b0f4aa6bbc7e86fe35d1137c35185df Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Tue, 19 Jul 2022 12:03:35 -0500
Subject: [PATCH 4/5] Updated date & version

---
 .../ssa___windows_lolbin_binary_in_non_standard_path.yml      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 0f3dd5e707..15ebfb6e05 100644
--- a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -1,7 +1,7 @@
 name: Windows LOLBin Binary in Non Standard Path
 id: 25689101-012a-324a-94d3-08301e6c065a
-version: 2
-date: '2022-06-22'
+version: 3
+date: '2022-07-19'
 author: Michael Haag, Splunk
 type: Anomaly
 datamodel:

From ca8a1a78e266fe426a45eaea8901e03517dae177 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Tue, 19 Jul 2022 13:36:18 -0500
Subject: [PATCH 5/5] Updated test filename

---
 .../ssa___windows_defender_tools_in_non_standard_path.test.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml b/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
index 0a273e259c..86f78587c0 100644
--- a/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
+++ b/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: UPDATE
+  - file_name: windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log
     source: XmlWinEventLog
     sourcetype: XmlWinEventLog