Merge branch 'develop' into Hives

.github/workflows/auto-merge.yml

@@ -1,17 +1,13 @@
-name: automerge
+name: auto-merge
 on:
-  pull_request:
+  pull_request_target:
 
 jobs:
-  automerge:
+  auto-merge:
     runs-on: ubuntu-latest
     steps:
-
-      - name: Print the name of the actor
-        run: |
-          echo "The name of the actor is [${{ github.actor }}]"
-      - name: automerge
-        uses: "pascalgn/automerge-action@v0.14.3"
-        if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]'
-        env:
-          GITHUB_TOKEN: "${{ secrets.PROTECTED_BRANCH_PUSH_TOKEN }}"
+      - uses: actions/checkout@v2
+      - uses: ahmadnassri/action-dependabot-auto-merge@v2
+        with:
+          target: minor
+          github-token: ${{ secrets.AUTOMERGE }}

automated_detection_testing/requirements.txt

@@ -6,7 +6,7 @@ atomicwrites==1.4.0
 attackcti==0.3.4.3
 attrs==21.2.0
 azure-common==1.1.27
-azure-core==1.16.0
+azure-core==1.18.0
 azure-identity==1.6.0
 azure-mgmt-compute==20.0.0
 azure-mgmt-core==1.2.1

detections/endpoint/add_defaultuser_and_password_in_registry.yml

@@ -0,0 +1,61 @@
+name: Add DefaultUser And Password In Registry
+id: d4a3eb62-0f1e-11ec-a971-acde48001122
+version: 1
+date: '2021-09-06'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: this search is to detect a suspicious registry modification to implement
+  auto admin logon to a host. This technique was seen in BlackMatter ransomware to
+  automatically logon to the compromise host after  triggering a safemode boot to
+  continue encrypting the whole network. This behavior is not a common practice and
+  really a suspicious TTP or alert need to be consider if found within then network
+  premise.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
+  NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR
+  Registry.registry_key_name= DefaultUserName by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: unknown
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+tags:
+  analytic_story:
+  - BlackMatter Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1552.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: modified registry key $registry_key_name$ with registry value $registry_value_name$
+    to prepare autoadminlogon
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/auto_admin_logon_registry_entry.yml

@@ -0,0 +1,61 @@
+name: Auto Admin Logon Registry Entry
+id: 1379d2b8-0f18-11ec-8ca3-acde48001122
+version: 1
+date: '2021-09-06'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: this search is to detect a suspicious registry modification to implement
+  auto admin logon to a host. This technique was seen in BlackMatter ransomware to
+  automatically logon to the compromise host after  triggering a safemode boot to
+  continue encrypting the whole network. This behavior is not a common practice and
+  really a suspicious TTP or alert need to be consider if found within then network
+  premise.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
+  NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND
+  Registry.registry_value_name=1 by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: unknown
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+tags:
+  analytic_story:
+  - BlackMatter Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1552.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  security_domain: endpoint
+  impact: 70
+  confidence: 90
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: modified registry key $registry_key_name$ with registry value $registry_value_name$
+    to prepare autoadminlogon
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml

@@ -0,0 +1,67 @@
+name: Bcdedit Command Back To Normal Mode Boot
+id: dc7a8004-0f18-11ec-8c54-acde48001122
+version: 1
+date: '2021-09-06'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious bcdedit commandline to configure
+  the host from safe mode back to normal boot configuration. This technique was seen
+  in blackMatter ransomware where it force the compromised host to boot in safe mode
+  to continue its encryption and bring back to normal boot using bcdedit deletevalue
+  command. This TTP can be a good alert for host that booted from safe mode forcefully
+  since it need to modify the boot configuration to bring it back to normal.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
+  Processes.process="*/deletevalue*" Processes.process="*{current}*"  Processes.process="*safeboot*"
+  by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
+  Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+tags:
+  analytic_story:
+  - BlackMatter Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1490
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  impact: 50
+  confidence: 70
+  risk_score: 35
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  message: bcdedit process with commandline $process$ to bring back to normal boot
+    configuration the $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/change_to_safe_mode_with_network_config.yml

@@ -0,0 +1,66 @@
+name: Change To Safe Mode With Network Config
+id: 81f1dce0-0f18-11ec-a5d7-acde48001122
+version: 1
+date: '2021-09-06'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious bcdedit commandline to configure
+  the host to boot in safe mode with network config. This technique was seen in blackMatter
+  ransomware where it force the compromised host to boot in safe mode to continue
+  its encryption and bring back to normal boot using bcdedit deletevalue command.
+  This TTP can be a good alert for host that booted from safe mode forcefully since
+  it need to modify the boot configuration to bring it back to normal.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
+  Processes.process="*/set*" Processes.process="*{current}*"  Processes.process="*safeboot*"
+  Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name
+  Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+tags:
+  analytic_story:
+  - BlackMatter Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1490
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  message: bcdedit process with commandline $process$ to force safemode boot the $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/known_services_killed_by_ransomware.yml

@@ -12,9 +12,10 @@ description: This search detects a suspicioous termination of known services kil
   the targetted files it wants to encrypts because of the open handle of those services
   to the targetted file.
 search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*",
-  "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service
-  entered the stopped state*" | stats count min(_time) as firstTime max(_time) as
-  lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
+  "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service entered the stopped state*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type 
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)`
   | `known_services_killed_by_ransomware_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the 7036 EventCode ScManager in System audit Logs from your endpoints.
@@ -26,6 +27,7 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - BlackMatter Ransomware
   automated_detection_testing: passed
   confidence: 80
   context:

detections/endpoint/modification_of_wallpaper.yml

@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - Ransomware
   - Revil Ransomware
+  - BlackMatter Ransomware
   automated_detection_testing: passed
   confidence: 90
   context:

detections/endpoint/ransomware_notes_bulk_creation.yml

@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - Clop Ransomware
   - DarkSide Ransomware
+  - BlackMatter Ransomware
   automated_detection_testing: passed
   confidence: 90
   context:

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -1,8 +1,8 @@
 name: Registry Keys Used For Persistence
 id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
-version: 5
-date: '2020-11-27'
-author: David Dorsey, Splunk
+version: 6
+date: '2021-09-07'
+author: Jose Hernandez, David Dorsey, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -10,14 +10,22 @@ description: The search looks for modifications to registry keys that can be use
   to launch an application or service at system startup.
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
   as registry_key_name values(Registry.registry_path) as registry_path min(_time)
-  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\run*
-  OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=CurrentVersion\\Winlogon\\Shell*
-  OR Registry.registry_path=*CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*CurrentVersion\\Winlogon\\VmApplet*
-  OR Registry.registry_path=*currentversion\\policies\\explorer\\run* OR Registry.registry_path=*currentversion\\runservices*
-  OR Registry.registry_path=*\\CurrentControlSet\\Control\\Lsa\\* OR Registry.registry_path="*Microsoft\\Windows
-  NT\\CurrentVersion\\Image File Execution Options*" OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*)
-  by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
-  | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter`'
+  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run*
+  OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell*
+  OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet*
+  OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices*
+  OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows
+  NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger)
+  OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security
+  Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig"
+  AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows
+  NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows"
+  AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion"
+  AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session
+  Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run"
+  AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user |
+  `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
+  | `registry_keys_used_for_persistence_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml

@@ -0,0 +1,66 @@
+name: SchCache Change By App Connect And Create ADSI Object
+id: 991eb510-0fc6-11ec-82d3-acde48001122
+version: 1
+date: '2021-09-07'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect an application try to connect and create ADSI
+  Object to do LDAP query. Every time an application connects to the directory and
+  attempts to create an ADSI object, the Active Directory Schema is checked for changes.
+  If it has changed since the last connection, the schema is downloaded and stored
+  in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache
+  or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious
+  application like blackmatter ransomware that use ADS object api to execute ldap
+  query. having a good list of ldap or normal AD query tool used within the network
+  is a good start to reduce the noise.
+search: '`sysmon` EventCode=11  TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename
+  = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) |stats count min(_time)
+  as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id  process_name
+  Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `schcache_change_by_app_connect_and_create_adsi_object_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: normal application like mmc.exe and other ldap query tool may
+  trigger this detections.
+references:
+- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+tags:
+  analytic_story:
+  - blackMatter ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - TargetFilename
+  - EventCode
+  - process_id
+  - process_name
+  - Computer
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - source:endpoint
+  - stage:Discovery
+  message: process $Image$ create a file $TargetFilename$ in host $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/system_information_discovery_detection.yml

@@ -1,7 +1,7 @@
 name: System Information Discovery Detection
 id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
-version: 1
-date: '2020-10-12'
+version: 2
+date: '2021-09-07'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
@@ -9,13 +9,18 @@ datamodel:
 description: Detect system information discovery techniques used by attackers to understand
   configurations of the system to further exploit it.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
-  OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
-  Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
-  | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest
-  > 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
-  by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `system_information_discovery_detection_filter`'
+    as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
+    OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
+    Processes.process_name Processes.process Processes.dest Processes.parent_process_name 
+| `drop_dm_object_name(Processes)` 
+| eventstats dc(process) as dc_processes_by_dest by dest 
+| where dc_processes_by_dest
+    > 2 
+| stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime
+    by user, dest parent_process_name
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `system_information_discovery_detection_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.

stories/ransomware_blackmatter.yml

@@ -0,0 +1,24 @@
+name: BlackMatter Ransomware
+id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee
+version: 1
+date: '2021-09-06'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the BlackMatter ransomware, including looking for file writes associated
+  with BlackMatter, force safe mode boot, autadminlogon account registry modification and more.
+narrative: blackMatter ransomware campaigns targeting healthcare and other vertical sectors, involve the use of
+  ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for
+  ransome of data and threaten deletion and exposure of exfiltrated data.
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+- https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/
+- https://blog.malwarebytes.com/ransomware/2021/07/blackmatter-a-new-ransomware-group-claims-link-to-darkside-revil/
+tags:
+  analytic_story: blackMatter Ransomware
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/add_defaultuser_and_password_in_registry.test.yml

@@ -0,0 +1,12 @@
+name: Add DefaultUser And Password In Registry Unit Test
+tests:
+- name: Add DefaultUser And Password In Registry
+  file: endpoint/add_defaultuser_and_password_in_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/auto_admin_logon_registry_entry.test.yml

@@ -0,0 +1,12 @@
+name: Auto Admin Logon Registry Entry Unit Test
+tests:
+- name: Auto Admin Logon Registry Entry
+  file: endpoint/auto_admin_logon_registry_entry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml

@@ -0,0 +1,12 @@
+name: Bcdedit Command Back To Normal Mode Boot Unit Test
+tests:
+- name: Bcdedit Command Back To Normal Mode Boot
+  file: endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/change_to_safe_mode_with_network_config.test.yml

@@ -0,0 +1,12 @@
+name: Change To Safe Mode With Network Config Unit Test
+tests:
+- name: Change To Safe Mode With Network Config
+  file: endpoint/change_to_safe_mode_with_network_config.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml

@@ -0,0 +1,12 @@
+name: SchCache Change By App Connect And Create ADSI Object Unit Test
+tests:
+- name: SchCache Change By App Connect And Create ADSI Object
+  file: endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog