From f8d6ce147dfed17408af3f39ef94c885eea4168e Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 19 Oct 2021 10:44:17 -0600
Subject: [PATCH 01/16] Curling

---
 ...ndows_curl_download_to_suspicious_path.yml | 79 +++++++++++++++++++
 macros/process_curl.yml                       |  3 +
 ..._curl_download_to_suspicious_path.test.yml | 12 +++
 3 files changed, 94 insertions(+)
 create mode 100644 detections/endpoint/windows_curl_download_to_suspicious_path.yml
 create mode 100644 macros/process_curl.yml
 create mode 100644 tests/endpoint/windows_curl_download_to_suspicious_path.test.yml

diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
new file mode 100644
index 0000000000..a097989050
--- /dev/null
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -0,0 +1,79 @@
+name: Windows Curl Download to Suspicious Path
+id: c32f091e-30db-11ec-8738-acde48001122
+version: 1
+date: '2021-10-19'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the use of Windows Curl.exe download a file to a suspicious location. \
+
+  -O or --output is used when a file is to be downloaded and placed in a specified location. \
+  
+  During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_curl`
+  Processes.process IN ("*-O *","--output") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_curl_download_to_suspicious_path_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+references:
+  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+  - https://attack.mitre.org/techniques/T1105/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
+tags:
+  analytic_story:
+  - IceID
+  - Ingress Tool Transfer
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1105
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/macros/process_curl.yml b/macros/process_curl.yml
new file mode 100644
index 0000000000..db7b6637b4
--- /dev/null
+++ b/macros/process_curl.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=curl.exe OR Processes.original_file_name=curl.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_curl
\ No newline at end of file
diff --git a/tests/endpoint/windows_curl_download_to_suspicious_path.test.yml b/tests/endpoint/windows_curl_download_to_suspicious_path.test.yml
new file mode 100644
index 0000000000..ff219bad72
--- /dev/null
+++ b/tests/endpoint/windows_curl_download_to_suspicious_path.test.yml
@@ -0,0 +1,12 @@
+name: Windows Curl Download to Suspicious Path Unit Test
+tests:
+- name: Windows Curl Download to Suspicious Path
+  file: endpoint/windows_curl_download_to_suspicious_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_curl.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From ee54fa595a4496479c80cce7b141b9d035529dd1 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 19 Oct 2021 10:45:39 -0600
Subject: [PATCH 02/16] Update windows_curl_download_to_suspicious_path.yml

---
 .../endpoint/windows_curl_download_to_suspicious_path.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
index a097989050..e408f65793 100644
--- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `security_content_ctime(lastTime)` 
   | `windows_curl_download_to_suspicious_path_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+known_false_positives: It is possible Administrators or super users will use Curl for legitimate purposes. Filter as needed.
 references:
   - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
   - https://attack.mitre.org/techniques/T1105/

From f7112aca6268d9dc792c912e814ea76aaf1348d9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 20 Oct 2021 07:08:14 -0600
Subject: [PATCH 03/16] fixes

---
 .../endpoint/windows_curl_download_to_suspicious_path.yml       | 2 +-
 macros/process_curl.yml                                         | 2 +-
 .../endpoint/windows_curl_download_to_suspicious_path.test.yml  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
index e408f65793..26a727f3d6 100644
--- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -13,7 +13,7 @@ description: 'The following analytic identifies the use of Windows Curl.exe down
   During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_curl`
-  Processes.process IN ("*-O *","--output") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process IN ("*-O *","*--output* ") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)`
diff --git a/macros/process_curl.yml b/macros/process_curl.yml
index db7b6637b4..45fc0e36f4 100644
--- a/macros/process_curl.yml
+++ b/macros/process_curl.yml
@@ -1,3 +1,3 @@
-definition: (Processes.process_name=curl.exe OR Processes.original_file_name=curl.exe)
+definition: (Processes.process_name=curl.exe OR Processes.original_file_name=Curl.exe)
 description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
 name: process_curl
\ No newline at end of file
diff --git a/tests/endpoint/windows_curl_download_to_suspicious_path.test.yml b/tests/endpoint/windows_curl_download_to_suspicious_path.test.yml
index ff219bad72..ad7a84bf3f 100644
--- a/tests/endpoint/windows_curl_download_to_suspicious_path.test.yml
+++ b/tests/endpoint/windows_curl_download_to_suspicious_path.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-sysmon_curl.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 682b9cbc74c46d5d75af537bf9b70a2b771c282c Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-89-94>
Date: Wed, 20 Oct 2021 13:34:35 +0000
Subject: [PATCH 04/16] Added detection testing service results inWindows Curl
 Download to Suspicious Path

---
 ...ndows_curl_download_to_suspicious_path.yml | 55 +++++++++++--------
 1 file changed, 32 insertions(+), 23 deletions(-)

diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
index 26a727f3d6..3702e8bdcd 100644
--- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -6,30 +6,38 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: 'The following analytic identifies the use of Windows Curl.exe download a file to a suspicious location. \
+description: 'The following analytic identifies the use of Windows Curl.exe download
+  a file to a suspicious location. \
 
-  -O or --output is used when a file is to be downloaded and placed in a specified location. \
-  
-  During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze.'
+  -O or --output is used when a file is to be downloaded and placed in a specified
+  location. \
+
+  During triage, review parallel processes for further behavior. In addition, identify
+  if the download was successful. If a file was downloaded, capture and analyze.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_curl`
-  Processes.process IN ("*-O *","*--output* ") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+  as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process
+  IN ("*-O *","*--output* ") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_curl_download_to_suspicious_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: It is possible Administrators or super users will use Curl for legitimate purposes. Filter as needed.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: It is possible Administrators or super users will use Curl
+  for legitimate purposes. Filter as needed.
 references:
-  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
-  - https://attack.mitre.org/techniques/T1105/
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://attack.mitre.org/techniques/T1105/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
 tags:
   analytic_story:
   - IceID
   - Ingress Tool Transfer
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -42,11 +50,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -54,12 +62,12 @@ tags:
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
   observable:
   - name: user
     type: User
@@ -76,4 +84,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  automated_detection_testing: passed

From ebfe0495342b103a2c5a845895bea2b4b710db2e Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 20 Oct 2021 15:25:48 -0600
Subject: [PATCH 05/16] Update windows_curl_download_to_suspicious_path.yml

---
 .../endpoint/windows_curl_download_to_suspicious_path.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
index 3702e8bdcd..24379b6342 100644
--- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -16,7 +16,7 @@ description: 'The following analytic identifies the use of Windows Curl.exe down
   if the download was successful. If a file was downloaded, capture and analyze.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process
-  IN ("*-O *","*--output* ") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*")
+  IN ("*-O *","*--output*") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*")
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

From 0772e6352b489294f1d22a6ca2c627a457efddbd Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 21 Oct 2021 09:56:27 -0600
Subject: [PATCH 06/16] taskscheduler hunting

---
 ...ws_task_scheduler_event_action_started.yml | 56 +++++++++++++++++++
 macros/wineventlog_task_scheduler.yml         |  4 ++
 ...sk_scheduler_event_action_started.test.yml | 12 ++++
 3 files changed, 72 insertions(+)
 create mode 100644 detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
 create mode 100644 macros/wineventlog_task_scheduler.yml
 create mode 100644 tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml

diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
new file mode 100644
index 0000000000..c2ddf9368d
--- /dev/null
+++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
@@ -0,0 +1,56 @@
+name: WinEvent Windows Task Scheduler Event Action Started
+id: b3632472-310b-11ec-9aab-acde48001122
+version: 1
+date: '2021-10-19'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: 'The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed).
+  It is recommended to filter based on ActionName by specifying specific paths not used in your environment. After some basic tuning, this may be effective in capturing evasive ways to register tasks on Windows.
+  Review parallel events related to tasks being scheduled. EventID 106 will generate when a new task is generated, however, that does not mean it ran. Capture any files on disk and analyze.'
+search: '`wineventlog_task_scheduler` EventID IN ("200","201") 
+  | rename Computer as dest 
+  | stats count min(_time) as firstTime max(_time) as lastTime by TaskName ActionName EventID dest ProcessID 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `winevent_windows_task_scheduler_event_action_started_filter`'
+how_to_implement: Task Scheduler logs are required to be collected. Enable logging with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] and renderXml=true.
+known_false_positives: False positives will be present. Filter based on ActionName paths or specify keywords of interest.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md
+  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IcedID
+  - Windows Persistence Techniques
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - TaskName 
+  - ActionName 
+  - EventID 
+  - dest
+  - ProcessID 
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: A Scheduled Task was scheduled and ran on $dest$.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
\ No newline at end of file
diff --git a/macros/wineventlog_task_scheduler.yml b/macros/wineventlog_task_scheduler.yml
new file mode 100644
index 0000000000..43aad75b53
--- /dev/null
+++ b/macros/wineventlog_task_scheduler.yml
@@ -0,0 +1,4 @@
+definition: sourcetype="xmlwineventlog" source="WinEventLog:Microsoft-Windows-TaskScheduler/Operational"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: wineventlog_task_scheduler
diff --git a/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
new file mode 100644
index 0000000000..eb50729acd
--- /dev/null
+++ b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
@@ -0,0 +1,12 @@
+name: WinEvent Windows Task Scheduler Event Action Started Unit Test
+tests:
+- name: WinEvent Windows Task Scheduler Event Action Started
+  file: endpoint/winevent_windows_task_scheduler_event_action_started.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-taskschedule.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/windows_taskschedule/windows-taskschedule.log
+    source: xmlwineventlog
+    sourcetype: WinEventLog:Microsoft-Windows-TaskScheduler/Operational
\ No newline at end of file

From 27521060d951c7ddaf2c6e270bc639fa5116a93c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 21 Oct 2021 12:07:26 -0600
Subject: [PATCH 07/16] Update wineventlog_task_scheduler.yml

---
 macros/wineventlog_task_scheduler.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/macros/wineventlog_task_scheduler.yml b/macros/wineventlog_task_scheduler.yml
index 43aad75b53..98f505c0f4 100644
--- a/macros/wineventlog_task_scheduler.yml
+++ b/macros/wineventlog_task_scheduler.yml
@@ -1,4 +1,4 @@
-definition: sourcetype="xmlwineventlog" source="WinEventLog:Microsoft-Windows-TaskScheduler/Operational"
+definition: (source="WinEventLog:Microsoft-Windows-TaskScheduler/Operational")
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
-name: wineventlog_task_scheduler
+name: wineventlog_task_scheduler
\ No newline at end of file

From 3dda0e6571d7b0faaa901975f755b73388850a61 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 21 Oct 2021 13:02:34 -0600
Subject: [PATCH 08/16] Update
 winevent_windows_task_scheduler_event_action_started.test.yml

---
 ...inevent_windows_task_scheduler_event_action_started.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
index eb50729acd..5004c5f25c 100644
--- a/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
+++ b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
@@ -3,7 +3,7 @@ tests:
 - name: WinEvent Windows Task Scheduler Event Action Started
   file: endpoint/winevent_windows_task_scheduler_event_action_started.yml
   pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
+  earliest_time: '-7d'
   latest_time: 'now'
   attack_data:
   - file_name: windows-taskschedule.log

From 9ef1d009e8ed46e8793145b07d07932c2e4d0dcf Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 9 Nov 2021 13:18:00 -0700
Subject: [PATCH 09/16] Update
 winevent_windows_task_scheduler_event_action_started.test.yml

---
 ...ent_windows_task_scheduler_event_action_started.test.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
index 5004c5f25c..aa454723f5 100644
--- a/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
+++ b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
@@ -3,10 +3,10 @@ tests:
 - name: WinEvent Windows Task Scheduler Event Action Started
   file: endpoint/winevent_windows_task_scheduler_event_action_started.yml
   pass_condition: '| stats count | where count > 0'
-  earliest_time: '-7d'
+  earliest_time: '-10d'
   latest_time: 'now'
   attack_data:
   - file_name: windows-taskschedule.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/windows_taskschedule/windows-taskschedule.log
-    source: xmlwineventlog
-    sourcetype: WinEventLog:Microsoft-Windows-TaskScheduler/Operational
\ No newline at end of file
+    source: WinEventLog:Microsoft-Windows-TaskScheduler/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 932eb17619a3f9151b0bd89d4b09bbb4f20c512b Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 9 Nov 2021 13:22:11 -0700
Subject: [PATCH 10/16] Update windows_curl_download_to_suspicious_path.yml

---
 .../endpoint/windows_curl_download_to_suspicious_path.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
index 24379b6342..9b56376649 100644
--- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: 'The following analytic identifies the use of Windows Curl.exe download
+description: 'The following analytic identifies the use of Windows Curl.exe downloading
   a file to a suspicious location. \
 
   -O or --output is used when a file is to be downloaded and placed in a specified

From babbd47d81c32f4545e527c4cdd0bf0709354b45 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 9 Nov 2021 13:42:23 -0700
Subject: [PATCH 11/16] Update wineventlog_task_scheduler.yml

---
 macros/wineventlog_task_scheduler.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/macros/wineventlog_task_scheduler.yml b/macros/wineventlog_task_scheduler.yml
index 98f505c0f4..2ce1703146 100644
--- a/macros/wineventlog_task_scheduler.yml
+++ b/macros/wineventlog_task_scheduler.yml
@@ -1,4 +1,4 @@
-definition: (source="WinEventLog:Microsoft-Windows-TaskScheduler/Operational")
+definition: source="WinEventLog:Microsoft-Windows-TaskScheduler/Operational"
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
 name: wineventlog_task_scheduler
\ No newline at end of file

From 24779bc8ef60602dca8086ecb0777e4490344a8c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 9 Nov 2021 13:47:05 -0700
Subject: [PATCH 12/16] Update
 winevent_windows_task_scheduler_event_action_started.test.yml

---
 ...inevent_windows_task_scheduler_event_action_started.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
index aa454723f5..5fc9cfcd9e 100644
--- a/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
+++ b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
@@ -3,7 +3,7 @@ tests:
 - name: WinEvent Windows Task Scheduler Event Action Started
   file: endpoint/winevent_windows_task_scheduler_event_action_started.yml
   pass_condition: '| stats count | where count > 0'
-  earliest_time: '-10d'
+  earliest_time: '-45d'
   latest_time: 'now'
   attack_data:
   - file_name: windows-taskschedule.log

From 205f059ed26769d4d8d27b52e4ae59a26b477756 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 10 Nov 2021 05:53:31 -0700
Subject: [PATCH 13/16] updated

---
 ...nevent_windows_task_scheduler_event_action_started.yml | 8 ++++----
 ...t_windows_task_scheduler_event_action_started.test.yml | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
index c2ddf9368d..4c21d68010 100644
--- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
@@ -9,13 +9,13 @@ datamodel:
 description: 'The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed).
   It is recommended to filter based on ActionName by specifying specific paths not used in your environment. After some basic tuning, this may be effective in capturing evasive ways to register tasks on Windows.
   Review parallel events related to tasks being scheduled. EventID 106 will generate when a new task is generated, however, that does not mean it ran. Capture any files on disk and analyze.'
-search: '`wineventlog_task_scheduler` EventID IN ("200","201") 
-  | rename Computer as dest 
-  | stats count min(_time) as firstTime max(_time) as lastTime by TaskName ActionName EventID dest ProcessID 
+search: '`wineventlog_task_scheduler` EventCode IN ("200","201") 
+  | rename ComputerName as dest 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Message dest EventCode category
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `winevent_windows_task_scheduler_event_action_started_filter`'
-how_to_implement: Task Scheduler logs are required to be collected. Enable logging with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] and renderXml=true.
+how_to_implement: Task Scheduler logs are required to be collected. Enable logging with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] and renderXml=false. Note, not translating it in XML may require a proper extraction of specific items in the Message. 
 known_false_positives: False positives will be present. Filter based on ActionName paths or specify keywords of interest.
 references:
   - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md
diff --git a/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
index 5fc9cfcd9e..497b878503 100644
--- a/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
+++ b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-taskschedule.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/windows_taskschedule/windows-taskschedule.log
     source: WinEventLog:Microsoft-Windows-TaskScheduler/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: wineventlog
\ No newline at end of file

From 89c82dbb7c29d9f45c384dad3759ec83ab8a7a6a Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-163-44>
Date: Wed, 10 Nov 2021 13:12:03 +0000
Subject: [PATCH 14/16] Added detection testing service results inWinEvent
 Windows Task Scheduler Event Action Started

---
 ...ws_task_scheduler_event_action_started.yml | 46 +++++++++++--------
 1 file changed, 27 insertions(+), 19 deletions(-)

diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
index 4c21d68010..4cd69afb82 100644
--- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
@@ -6,25 +6,33 @@ author: Michael Haag, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: 'The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed).
-  It is recommended to filter based on ActionName by specifying specific paths not used in your environment. After some basic tuning, this may be effective in capturing evasive ways to register tasks on Windows.
-  Review parallel events related to tasks being scheduled. EventID 106 will generate when a new task is generated, however, that does not mean it ran. Capture any files on disk and analyze.'
-search: '`wineventlog_task_scheduler` EventCode IN ("200","201") 
-  | rename ComputerName as dest 
-  | stats count min(_time) as firstTime max(_time) as lastTime by Message dest EventCode category
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+description: The following hunting analytic assists with identifying suspicious tasks
+  that have been registered and ran in Windows using EventID 200 (action run) and
+  201 (action completed). It is recommended to filter based on ActionName by specifying
+  specific paths not used in your environment. After some basic tuning, this may be
+  effective in capturing evasive ways to register tasks on Windows. Review parallel
+  events related to tasks being scheduled. EventID 106 will generate when a new task
+  is generated, however, that does not mean it ran. Capture any files on disk and
+  analyze.
+search: '`wineventlog_task_scheduler` EventCode IN ("200","201") | rename ComputerName
+  as dest | stats count min(_time) as firstTime max(_time) as lastTime by Message
+  dest EventCode category | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `winevent_windows_task_scheduler_event_action_started_filter`'
-how_to_implement: Task Scheduler logs are required to be collected. Enable logging with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] and renderXml=false. Note, not translating it in XML may require a proper extraction of specific items in the Message. 
-known_false_positives: False positives will be present. Filter based on ActionName paths or specify keywords of interest.
+how_to_implement: Task Scheduler logs are required to be collected. Enable logging
+  with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational]
+  and renderXml=false. Note, not translating it in XML may require a proper extraction
+  of specific items in the Message.
+known_false_positives: False positives will be present. Filter based on ActionName
+  paths or specify keywords of interest.
 references:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md
-  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IcedID
   - Windows Persistence Techniques
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/windows_taskschedule/windows-taskschedule.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -35,15 +43,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - TaskName 
-  - ActionName 
-  - EventID 
+  - TaskName
+  - ActionName
+  - EventID
   - dest
-  - ProcessID 
+  - ProcessID
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
   - Source:Endpoint
@@ -53,4 +60,5 @@ tags:
   - name: dest
     type: Hostname
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 7b82199ce96179358fdad2d522ed0200d6ee1039 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 10 Nov 2021 08:59:59 -0700
Subject: [PATCH 15/16] Curl to upload

---
 ...dows_curl_upload_to_remote_destination.yml | 84 +++++++++++++++++++
 ...curl_upload_to_remote_destination.test.yml | 12 +++
 2 files changed, 96 insertions(+)
 create mode 100644 detections/endpoint/windows_curl_upload_to_remote_destination.yml
 create mode 100644 tests/endpoint/windows_curl_upload_to_remote_destination.test.yml

diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
new file mode 100644
index 0000000000..97fe4b1f16
--- /dev/null
+++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
@@ -0,0 +1,84 @@
+name: Windows Curl Upload to Remote Destination
+id: 42f8f1a2-4228-11ec-aade-acde48001122
+version: 1
+date: '2021-11-10'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the use of Windows Curl.exe uploading
+  a file to a remote destination. \
+
+  `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \
+
+  `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \
+
+  HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \
+
+  Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt).
+  During triage, review parallel processes for further behavior. In addition, identify
+  if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process
+  IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_curl_upload_to_remote_destination_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be limited to source control applications and may be required to be filtered out. 
+references:
+  - https://everything.curl.dev/usingcurl/uploads
+  - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
+  - https://twitter.com/d1r4c/status/1279042657508081664?s=20
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  dataset: []
+  kill_chain_phases:
+  - Exfiltration
+  mitre_attack_id:
+  - T1105
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ uploading a file to a remote destination.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/windows_curl_upload_to_remote_destination.test.yml b/tests/endpoint/windows_curl_upload_to_remote_destination.test.yml
new file mode 100644
index 0000000000..c73362b2f8
--- /dev/null
+++ b/tests/endpoint/windows_curl_upload_to_remote_destination.test.yml
@@ -0,0 +1,12 @@
+name: Windows Curl Upload to Remote Destination Unit Test
+tests:
+- name: Windows Curl Upload to Remote Destination
+  file: endpoint/windows_curl_upload_to_remote_destination.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_curl_upload.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From b2225bf9de37de321a6f1ffaecf563504f0cc8cb Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-207-170>
Date: Wed, 10 Nov 2021 16:59:52 +0000
Subject: [PATCH 16/16] Added detection testing service results inWindows Curl
 Upload to Remote Destination

---
 ...dows_curl_upload_to_remote_destination.yml | 56 +++++++++++--------
 1 file changed, 34 insertions(+), 22 deletions(-)

diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
index 97fe4b1f16..95d092ccba 100644
--- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml
+++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
@@ -9,32 +9,43 @@ datamodel:
 description: 'The following analytic identifies the use of Windows Curl.exe uploading
   a file to a remote destination. \
 
-  `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \
+  `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
+  \
 
-  `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \
+  `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
+  web application, and it is, for example, how most common HTML forms on the web work.
+  \
 
-  HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \
+  HTTP multipart formposts are done with `-F`, but this appears to not be compatible
+  with the Windows version of Curl. Will update if identified adversary tradecraft.
+  \
 
-  Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt).
-  During triage, review parallel processes for further behavior. In addition, identify
-  if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.'
+  Adversaries may use one of the three methods based on the remote destination and
+  what they are attempting to upload (zip vs txt). During triage, review parallel
+  processes for further behavior. In addition, identify if the upload was successful
+  in network logs. If a file was uploaded, isolate the endpoint and review.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process
-  IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *")
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `windows_curl_upload_to_remote_destination_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be limited to source control applications and may be required to be filtered out. 
+  IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_upload_to_remote_destination_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be limited to source control applications
+  and may be required to be filtered out.
 references:
-  - https://everything.curl.dev/usingcurl/uploads
-  - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
-  - https://twitter.com/d1r4c/status/1279042657508081664?s=20
+- https://everything.curl.dev/usingcurl/uploads
+- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
+- https://twitter.com/d1r4c/status/1279042657508081664?s=20
 tags:
   analytic_story:
   - Ingress Tool Transfer
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
   kill_chain_phases:
   - Exfiltration
   mitre_attack_id:
@@ -47,11 +58,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -81,4 +92,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  automated_detection_testing: passed