From 8a43aa3033daa1682a7d43ffb3db777549415b50 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 22 Feb 2022 16:46:33 -0800
Subject: [PATCH] Another fix for the Ports change

---
 ...tallutil_uninstall_option_with_network.yml | 27 ++++++++++---------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
index 039a92f7d1..aa979ec98f 100644
--- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
+++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
@@ -1,7 +1,7 @@
 name: Windows InstallUtil Uninstall Option with Network
 id: 1a52c836-43ef-11ec-a36c-acde48001122
-version: 1
-date: '2021-11-12'
+version: 2
+date: '2022-02-22'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -24,16 +24,19 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
 
   During triage review resulting network connections, file modifications, and parallel
   processes. Capture any artifacts and review further.'
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time
-  span=1h  Processes.process_guid Processes.process_name Processes.dest Processes.process_path
-  Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join  process_guid
-  [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports
-  where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
-  | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
-  original_file_name process_path process process_guid connection_to_CNC dest_port
-  | `windows_installutil_uninstall_option_with_network_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes 
+  where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") 
+  by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | join process_guid 
+    [ | tstats `security_content_summariesonly` count FROM 
+        datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port !="0" by All_Traffic.process_guid All_Traffic.dest All_Traffic.dest_port 
+      | `drop_dm_object_name(All_Traffic)` 
+      | rename dest as connection_to_CNC] 
+| table _time dest parent_process_name process_name original_file_name process_path process process_guid connection_to_CNC dest_port 
+| `windows_installutil_uninstall_option_with_network_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.