Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm

detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml

@@ -16,7 +16,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
 references:
@@ -58,11 +62,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml

@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-  - Endpoint
+- Endpoint
 description: The following analytic identifies gpupdate.exe with no command line arguments.
   It is unusual for gpupdate.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
@@ -62,11 +62,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml

@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-  - Endpoint
+- Endpoint
 description: The following analytic identifies rundll32.exe with no command line arguments.
   It is unusual for rundll32.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
@@ -17,7 +17,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:
@@ -69,11 +73,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path