merged with develop

detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml

@@ -0,0 +1,94 @@
+name: Okta Mismatch Between Source and Response for Verify Push Request
+id: 8085b79b-9b85-4e67-ad63-351c9e9a5e9a
+version: 1
+date: '2023-03-17'
+author: John Murphy and Jordan Ruocco, Okta, Michael Haag, Splunk
+type: TTP
+status: experimental
+data_source: []
+description: 'The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\
+
+  For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \
+  
+  Source of Push (Sign-In) \
+
+  eventType eq \"system.push.send_factor_verify_push\" \
+
+  User Push Response (Okta Verify client) \
+
+  eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \
+
+  In sequence, the logic for the analytic - \
+  
+  * Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \
+
+  * Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \
+  * Creates a ratio of successful sign-ins to pushes. \
+
+  * If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.'
+search: '`okta` eventType IN (system.push.send_factor_verify_push) OR
+  (eventType IN (user.authentication.auth_via_mfa)
+  debugContext.debugData.factor="OKTA_VERIFY_PUSH")
+  | eval groupby="authenticationContext.externalSessionId"
+  | eval group_push_time=_time
+  | bin span=2s group_push_time
+  | fillnull value=NULL
+  | stats min(_time) as _time by authenticationContext.externalSessionId eventType
+  debugContext.debugData.factor outcome.result actor.alternateId client.device client.ipAddress
+  client.userAgent.rawUserAgent debugContext.debugData.behaviors group_push_time groupby
+  | iplocation client.ipAddress
+  | fields - lat, lon, group_push_time
+  | stats min(_time) as _time dc(client.ipAddress) as dc_ip
+  sum(eval(if(eventType="system.push.send_factor_verify_push" AND
+  "outcome.result"="SUCCESS",1,0))) as total_pushes
+  sum(eval(if(eventType="user.authentication.auth_via_mfa" AND
+  "outcome.result"="SUCCESS",1,0))) as total_successes
+  sum(eval(if(eventType="user.authentication.auth_via_mfa" AND
+  "outcome.result"="FAILURE",1,0))) as total_rejected
+  sum(eval(if(eventType="system.push.send_factor_verify_push" AND
+  "debugContext.debugData.behaviors" LIKE "%New Device=POSITIVE%",1,0))) as suspect_device_from_source
+  sum(eval(if(eventType="system.push.send_factor_verify_push" AND
+  "debugContext.debugData.behaviors" LIKE "%New IP=POSITIVE%",0,0))) as suspect_ip_from_source
+  values(eval(if(eventType="system.push.send_factor_verify_push","client.ipAddress",""))) as src
+  values(eval(if(eventType="user.authentication.auth_via_mfa","client.ipAddress",""))) as dest
+  values(*) as * by groupby
+  | eval ratio = round(total_successes/total_pushes,2)
+  | search ((ratio < 0.5 AND total_pushes > 1) OR (total_rejected > 0)) AND dc_ip > 1 AND
+  suspect_device_from_source > 0 AND suspect_ip_from_source > 0 | `okta_mismatch_between_source_and_response_for_verify_push_request_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+known_false_positives: False positives may be present based on organization size and configuration of Okta. Monitor, tune and filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1621
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  - Okta MFA Exhaustion
+  asset_type: Infrastructure
+  confidence: 80
+  impact: 80
+  message: A mismatch between source and response for verifying a push request has occurred for $actor.alternateId$
+  mitre_attack_id:
+  - T1621
+  observable:
+  - name: actor.alternateId
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - authenticationContext.externalSessionId 
+  - eventType
+  - debugContext.debugData.factor 
+  - outcome.result 
+  - actor.alternateId 
+  - client.device 
+  - client.ipAddress
+  - client.userAgent.rawUserAgent 
+  - debugContext.debugData.behaviors 
+  - group_push_time
+  risk_score: 64
+  security_domain: access

detections/application/okta_multiple_failed_requests_to_access_applications.yml

@@ -0,0 +1,52 @@
+name: Okta Multiple Failed Requests to Access Applications
+id: 1c21fed1-7000-4a2e-9105-5aaafa437247
+version: 1
+date: '2023-03-17'
+author: John Murphy, Okta, Michael Haag, Splunk
+type: Hunting
+status: experimental
+data_source: []
+description: 'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \
+  * Retrieves policy evaluation and SSO details in events that contain the Application requested \
+
+  * Formats target fields so we can aggregate specifically on Applications (AppInstances) \
+
+  * Groups by User, Session and IP \
+
+  * Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies \
+
+  * Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.'
+search: "`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip('target{}.type', 'target{}.displayName', \": \") | eval targets=mvfilter(targets LIKE \"AppInstance%\") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType=\"policy.evaluate_sign_on\",targets,NULL))) as total_challenges sum(eval(if(eventType=\"user.authentication.sso\",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if(\"outcome.result\"=\"SUCCESS\",targets,NULL))) as success_apps values(eval(if(\":outcome.result\"!=\"SUCCESS\",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity=\"HIGH\", mitre_technique_id=\"T1538\", description=\"actor.alternateId\". \" from \" . \"client.ipAddress\" . \" seen opening \" . total_challenges . \" chiclets/apps with \" . total_successes . \" challenges successfully passed\" | fields - count, targets | search ratio < 0.5 total_challenges > 2` | okta_multiple_failed_requests_to_access_applications_filter`"
+how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+known_false_positives: False positives may be present based on organization size and configuration of Okta. 
+references:
+- https://attack.mitre.org/techniques/T1538
+- https://attack.mitre.org/techniques/T1550/004
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  confidence: 70
+  impact: 80
+  message: Multiple Failed Requests to Access Applications via Okta for $actor.alternateId$.
+  mitre_attack_id:
+  - T1550.004
+  - T1538
+  observable:
+  - name: actor.alternateId
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - authenticationContext.externalSessionId 
+  - targets 
+  - actor.alternateId 
+  - client.ipAddress
+  - eventType
+  risk_score: 56
+  security_domain: access

detections/application/okta_phishing_detection_with_fastpass_origin_check.yml

@@ -0,0 +1,48 @@
+name: Okta Phishing Detection with FastPass Origin Check
+id: f4ca0057-cbf3-44f8-82ea-4e330ee901d3
+version: 1
+date: '2023-03-09'
+author: Okta, Inc, Michael Haag, Splunk
+type: TTP
+status: experimental
+data_source: []
+description: The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies.
+  Okta''s Defensive Cyber Operations team routinely identifies phishing infrastructure configured to imitate an Okta sign-in page and proactively notify Okta customers when suspicious infrastructure we detect appears to be targeting their users. Since March 2020, we have delivered over 1000 notifications to customers.
+search: '`okta` eventType="user.authentication.auth_via_mfa" AND result="FAILURE" AND outcome.reason="FastPass declined phishing attempt"
+| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser outcome.reason
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` | `okta_phishing_detection_with_fastpass_origin_check_filter`'
+how_to_implement: This search is specific to Okta and requires Okta logs to be
+  ingested in your Splunk deployment.
+known_false_positives: Fidelity of this is high as Okta is specifying malicious infrastructure. Filter and modify as needed.
+references:
+- https://sec.okta.com/fastpassphishingdetection
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  confidence: 100
+  impact: 100
+  message: Okta FastPass has prevented $user$ from authenticating to a malicious site.
+  mitre_attack_id:
+  - T1078
+  - T1078.001
+  - T1556
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventType 
+  - client.userAgent.rawUserAgent 
+  - client.userAgent.browser 
+  - outcome.reason
+  - displayMessage
+  risk_score: 100
+  security_domain: access

detections/application/okta_suspicious_use_of_a_session_cookie.yml

@@ -0,0 +1,58 @@
+name: Okta Suspicious Use of a Session Cookie
+id: 71ad47d1-d6bd-4e0a-b35c-020ad9a6959e
+version: 1
+date: '2023-03-17'
+author: Scott Dermott and Felicity Robson, Okta, Michael Haag, Splunk
+type: Hunting
+status: experimental
+data_source: []
+description: 'The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. \
+
+  * Retrieves policy evaluation events from successful authentication events. \
+
+  * Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. \
+
+  * Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.'
+search: '`okta` eventType IN (policy.evaluate_sign_on) outcome.result IN
+  (ALLOW, SUCCESS) | stats earliest(_time) as _time values(client.ipAddress) as src_ip
+  values(client.userAgent.rawUserAgent) as user_agent values(client.userAgent.os) as
+  userAgentOS_list values(client.geographicalContext.city) as city values(client.userAgent.browser) as userAgentBrowser_list
+  values(device.os_platform) as okta_device_os dc(client.userAgent.browser) as dc_userAgentBrowser
+  dc(client.userAgent.os) as dc_userAgentOS dc(client.ipAddress) as dc_src_ip
+  values(outcome.reason) as reason by debugContext.debugData.dtHash actor.alternateId
+  | where dc_src_ip>1 AND (dc_userAgentOS>1 OR dc_userAgentBrowser>1)
+  | `okta_suspicious_use_of_a_session_cookie_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+known_false_positives: False positives may be present based on organization size and configuration of Okta. 
+references:
+  - https://attack.mitre.org/techniques/T1539/
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  confidence: 70
+  impact: 80
+  message: A suspicious use of a session cookie was identified by user $actor.alternateId$. 
+  mitre_attack_id:
+  - T1539
+  observable:
+  - name: actor.alternateId
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - client.ipAddress
+  - client.userAgent.rawUserAgent
+  - client.userAgent.os
+  - client.geographicalContext.city
+  - client.userAgent.browser
+  - device.os_platform
+  - debugContext.debugData.dtHash
+  - actor.alternateId
+  risk_score: 56
+  security_domain: access

detections/application/okta_threatinsight_login_failure_with_high_unknown_users.yml

@@ -0,0 +1,43 @@
+name: Okta ThreatInsight Login Failure with High Unknown users
+id: 632663b0-4562-4aad-abe9-9f621a049738
+version: 1
+date: '2023-03-09'
+author: Okta, Inc, Michael Haag, Splunk
+type: TTP
+status: experimental
+data_source: []
+description: The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+search: '`okta` eventType="security.threat.detected" AND outcome.reason="Login failures with high unknown users count*"
+| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser outcome.reason
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` | `okta_threatinsight_login_failure_with_high_unknown_users_filter`'
+how_to_implement: This search is specific to Okta and requires Okta logs to be
+  ingested in your Splunk deployment.
+known_false_positives: Fidelity of this is high as it is Okta ThreatInsight. Filter and modify as needed.
+references:
+- https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  confidence: 100
+  impact: 50
+  message: Okta ThreatInsight has detected or prevented a high number of login failures.
+  mitre_attack_id:
+  - T1078
+  - T1078.001
+  - T1110.004
+  observable: []
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventType 
+  - client.userAgent.rawUserAgent 
+  - client.userAgent.browser 
+  - outcome.reason
+  - displayMessage
+  risk_score: 50
+  security_domain: access

detections/application/okta_threatinsight_suspected_passwordspray_attack.yml

@@ -0,0 +1,43 @@
+name: Okta ThreatInsight Suspected PasswordSpray Attack
+id: 25dbad05-6682-4dd5-9ce9-8adecf0d9ae2
+version: 1
+date: '2023-03-09'
+author: Okta, Inc, Michael Haag, Splunk
+type: TTP
+status: experimental
+data_source: []
+description: The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+search: '`okta` eventType="security.threat.detected" AND outcome.reason="Password Spray"
+| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by eventType client.userAgent.rawUserAgent client.userAgent.browser outcome.reason
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` | `okta_threatinsight_suspected_passwordspray_attack_filter`'
+how_to_implement: This search is specific to Okta and requires Okta logs to be
+  ingested in your Splunk deployment.
+known_false_positives: Fidelity of this is high as it is Okta ThreatInsight. Filter and modify as needed.
+references:
+- https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  confidence: 100
+  impact: 60
+  message: Okta ThreatInsight has detected or prevented a PasswordSpray attack.
+  mitre_attack_id:
+  - T1078
+  - T1078.001
+  - T1110.003
+  observable: []
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventType 
+  - client.userAgent.rawUserAgent 
+  - client.userAgent.browser 
+  - outcome.reason
+  - displayMessage
+  risk_score: 60
+  security_domain: access

detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml

@@ -3,19 +3,18 @@ id: 08978eca-caff-44c1-84dc-53f17def4e14
 version: 1
 date: '2023-02-14'
 author: Chase Franklin, Rod Soto, Splunk
-status: production
+status: experimental
 type: TTP
 description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, when the
   INGEST\\_EVAL parameter is improperly formatted, it crashes splunkd. This hunting
   search provides the user, timing and number of times the crashing command was executed.
 data_source: []
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*"
-  AND Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc
-  Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info
-  Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type
-  | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` |
-  `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
+  from datamodel=Splunk_Audit.Search_Activity 
+  where (Search_Activity.search="*makeresults*"AND Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc Search_Activity.search!="*splunk_improperly_formatted_parameter_crashes_splunkd_filter*" Search_Activity.user!=splunk-system-user 
+  by Search_Activity.search, Search_Activity.info, Search_Activity.total_run_time, Search_Activity.user, Search_Activity.search_type
+  | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`'
 how_to_implement: Requires access to audittrail and use of Splunk_Audit.Search_Activity
   datamodel.
 known_false_positives: This is a hunting search it should be focused on affected products,

detections/endpoint/msmpeng_application_dll_side_loading.yml

@@ -1,7 +1,7 @@
 name: Msmpeng Application DLL Side Loading
 id: 8bb3f280-dd9b-11eb-84d5-acde48001122
-version: 2
-date: '2021-07-05'
+version: 3
+date: '2023-03-15'
 author: Teoderick Contreras, Splunk, Sanjay Govind
 status: production
 type: TTP
@@ -14,8 +14,8 @@ data_source:
 - Sysmon Event ID 11
 search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as
   file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
-  where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll")  AND
-  Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time
+  where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll")  AND NOT 
+  (Filesystem.file_path IN ("*\\Program Files\\windows defender\\*","*\\WinSxS\\*defender-service*","*\\WinSxS\\Temp\\*defender-service*")) by Filesystem.file_create_time
   Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/office_application_drop_executable.yml

@@ -38,6 +38,7 @@ tags:
   analytic_story:
   - FIN7
   - AgentTesla
+  - CVE-2023-21716 Word RTF Heap Corruption
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/office_product_spawn_cmd_process.yml

@@ -42,6 +42,7 @@ tags:
   - Remcos
   - Qakbot
   - AgentTesla
+  - CVE-2023-21716 Word RTF Heap Corruption
   asset_type: Endpoint
   confidence: 80
   impact: 70

detections/endpoint/possible_lateral_movement_powershell_spawn.yml

@@ -22,7 +22,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe)
   (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*)
   OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*))
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting

detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml

@@ -1,7 +1,7 @@
 name: Suspicious DLLHost no Command Line Arguments
 id: ff61e98c-0337-4593-a78f-72a676c56f26
-version: 3
-date: '2022-03-15'
+version: 4
+date: '2023-03-08'
 author: Michael Haag, Splunk
 status: production
 type: TTP

detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml

@@ -4,23 +4,21 @@ version: 1
 date: '2023-01-12'
 author: Teoderick Contreras, Splunk
 status: production
-type: TTP
-description: This analytic will identify suspicious files dropped or created in the
-  Windows %startup% folder. This technique is a common way to gain persistence on
-  a targeted host. Threat actor, adversaries and red teamer abuse this folder path
-  to automatically execute their malicious sample upon boot or restart of the infected
-  host. This TTP detection is a good indicator that a suspicious process wants to
-  gain persistence on the targeted host. We suggest to verify the process name by
-  using the process guid field, the file created and also the user and the computer
-  name for further investigation.
+type: Anomaly
+description: This analytic will identify suspicious files dropped or created in the Windows %startup% folder. 
+  This technique is a common way to gain persistence on a targeted host. Threat actor, adversaries and red teamer 
+  abuse this folder path to automatically execute their malicious sample upon boot or restart of the infected host. 
+  This TTP detection is a good indicator that a suspicious process wants to gain persistence on the targeted host. We suggest to 
+  verify the process name by using the process guid field, the file created and also the user and the computer name for further investigation.
 data_source:
 - Sysmon Event ID 11
-search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path = "*\\Microsoft\\Windows\\Start
-  Menu\\Programs\\Startup\\*" by Filesystem.file_create_time Filesystem.process_id
-  Filesystem.file_name Filesystem.user Filesystem.file_path Filesystem.process_guid
-  Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_boot_or_logon_autostart_execution_in_startup_folder_filter`'
+search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
+  where Filesystem.file_path = "*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" 
+  by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user Filesystem.file_path Filesystem.process_guid Filesystem.dest
+  | `drop_dm_object_name(Filesystem)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_boot_or_logon_autostart_execution_in_startup_folder_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the Filesystem responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Filesystem` node.

detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml

@@ -4,27 +4,24 @@ version: 1
 date: '2022-10-20'
 author: Teoderick Contreras, Splunk
 status: production
-type: TTP
-description: The following analytic identifies the suspicious child process of calc.exe
-  due to dll side loading technique to execute another executable. This technique
-  was seen in qakbot malware that uses dll side loading technique to calc applications
-  to load its malicious dll code. The malicious dll that abuses dll side loading technique
-  will load the actual qakbot loader dll using regsvr32.exe application. This TTP
-  is a good indicator of qakbot since the calc.exe will not load other child processes
-  aside from win32calc.exe.
+type: Anomaly
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
-  = "calc.exe")  AND Processes.process_name != "win32calc.exe" by Processes.parent_process
-  Processes.process_name Processes.process_id Processes.process_guid Processes.process
-  Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` | `windows_dll_side_loading_process_child_of_calc_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+description: The following analytic identifies the suspicious child process of calc.exe due to dll side loading technique to execute another executable. 
+  This technique was seen in qakbot malware that uses dll side loading technique to calc applications to load its malicious dll code. The malicious dll that abuses 
+  dll side loading technique will load the actual qakbot loader dll using regsvr32.exe application. 
+  This TTP is a good indicator of qakbot since the calc.exe will not load other child processes aside from win32calc.exe.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where (Processes.parent_process_name = "calc.exe")  AND Processes.process_name != "win32calc.exe"
+  by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_dll_side_loading_process_child_of_calc_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process 
+  that include the name of the process responsible for the changes from your endpoints into the `Endpoint` 
+  datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and 
+  the latest TA for the endpoint product.
 known_false_positives: unknown
 references:
 - https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot

detections/endpoint/windows_powershell_import_applocker_policy.yml

@@ -32,6 +32,9 @@ tags:
     with EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1059.001
+  - T1059
+  - T1562.001
+  - T1562
   observable:
   - name: Computer
     type: Hostname

detections/endpoint/windows_registry_delete_task_sd.yml

@@ -4,7 +4,7 @@ version: 1
 date: '2022-04-13'
 author: Michael Haag, Splunk
 status: production
-type: TTP
+type: Anomaly
 description: The following analytic identifies a process attempting to delete a scheduled
   task SD (Security Descriptor) from within the registry path of that task. This may
   occur from a non-standard process running and may not come from reg.exe. This particular

detections/endpoint/windows_rundll32_webdav_request.yml

@@ -0,0 +1,72 @@
+name: Windows Rundll32 WebDAV Request
+id: 320099b7-7eb1-4153-a2b4-decb53267de2
+version: 1
+date: '2023-03-15'
+author: Michael Haag, Splunk
+type: TTP
+status: production
+data_source:
+- Sysmon Event ID 1
+description: The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. This particular behavior was recently showcased in CVE-2023-23397.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*","*\\windows\\syswow64\\davclnt.dll,*davsetcookie*")
+   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_rundll32_webdav_request_filter`'
+how_to_implement: In addition to getting the correct data, adding a join with network connection will assist with making this higher fidelity. We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be present based on legitimate software, filtering may need to occur.
+references:
+  - https://strontic.github.io/xcyclopedia/library/davclnt.dll-0EA3050E7CC710526E330C413C165DA0.html
+  - https://twitter.com/ACEResponder/status/1636116096506818562?s=20
+  - https://twitter.com/domchell/status/1635999068282408962?s=20
+  - https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
+  - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
+tags:
+  analytic_story:
+  - CVE-2023-23397 Outlook Elevation of Privilege
+  asset_type: Endpoint
+  cve:
+  - CVE-2023-23397
+  confidence: 60
+  impact: 80
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
+  mitre_attack_id:
+  - T1048.003
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 48
+  security_domain: endpoint

detections/endpoint/windows_rundll32_webdav_with_network_connection.yml

@@ -0,0 +1,84 @@
+name: Windows Rundll32 WebDav With Network Connection
+id: f03355e0-28b5-4e9b-815a-6adffc63b38c
+version: 1
+date: '2023-03-16'
+author: Michael Haag, Splunk
+type: TTP
+status: experimental
+data_source: []
+description: The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. The analytic attempts to use join from Processes and All_Traffic to identify the network connection. This particular behavior was recently showcased in CVE-2023-23397.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name=svchost.exe `process_rundll32` Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*", "*\\windows\\syswow64\\davclnt.dll,*davsetcookie*") by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | rename dest as src
+  | join host process_id 
+  [
+  | tstats `security_content_summariesonly` count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port!=0 
+  NOT (All_Traffic.dest_ip IN (10.0.0.0/12, 172.16.0.0/12, 192.168.0.0/16))  by host All_Traffic.process_id 
+  | `drop_dm_object_name(All_Traffic)`]
+  | `windows_rundll32_webdav_with_network_connection_filter`'
+how_to_implement: We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and the All_Traffic Datamodel. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be present based on legitimate software, filtering may need to occur.
+references:
+  - https://strontic.github.io/xcyclopedia/library/davclnt.dll-0EA3050E7CC710526E330C413C165DA0.html
+  - https://twitter.com/ACEResponder/status/1636116096506818562?s=20
+  - https://twitter.com/domchell/status/1635999068282408962?s=20
+  - https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
+  - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
+tags:
+  analytic_story:
+  - CVE-2023-23397 Outlook Elevation of Privilege
+  asset_type: Endpoint
+  cve:
+  - CVE-2023-23397
+  confidence: 60
+  impact: 80
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
+  mitre_attack_id:
+  - T1048.003
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - All_Traffic.dest_port
+  - All_Traffic.dest_ip
+  - All_Traffic.dest
+  risk_score: 48
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/cve-2023-23397/webdav_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/winword_spawning_cmd.yml

@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - Spearphishing Attachments
   - DarkCrystal RAT
+  - CVE-2023-21716 Word RTF Heap Corruption
   asset_type: Endpoint
   confidence: 100
   impact: 70

detections/endpoint/winword_spawning_powershell.yml

@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - Spearphishing Attachments
   - DarkCrystal RAT
+  - CVE-2023-21716 Word RTF Heap Corruption
   asset_type: Endpoint
   confidence: 100
   impact: 70

detections/endpoint/winword_spawning_windows_script_host.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - CVE-2023-21716 Word RTF Heap Corruption
   asset_type: Endpoint
   confidence: 100
   impact: 70

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.61.0"
+      "version": "3.62.0"
     }, 
     "author": [
       {

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-16T08:34:28 UTC
+# On Date: 2023-03-23T09:34:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -129,6 +129,39 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed. Drop to anomaly until tuning is complete.
 providing_technologies = null
 
+[savedsearch://ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\
+For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \
+Source of Push (Sign-In) \
+eventType eq \"system.push.send_factor_verify_push\" \
+User Push Response (Okta Verify client) \
+eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \
+In sequence, the logic for the analytic - \
+* Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \
+* Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \ * Creates a ratio of successful sign-ins to pushes. \
+* If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.
+how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present based on organization size and configuration of Okta. Monitor, tune and filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Okta Multiple Failed Requests to Access Applications - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \ * Retrieves policy evaluation and SSO details in events that contain the Application requested \
+* Formats target fields so we can aggregate specifically on Applications (AppInstances) \
+* Groups by User, Session and IP \
+* Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies \
+* Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.
+how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550.004", "T1538"], "nist": ["DE.AE"]}
+known_false_positives = False positives may be present based on organization size and configuration of Okta.
+providing_technologies = null
+
 [savedsearch://ESCU - Okta New API Token Created - Rule]
 type = detection
 asset_type = Infrastructure
@@ -149,6 +182,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Deliv
 known_false_positives = Tune the risk score as needed based on your organization.
 providing_technologies = null
 
+[savedsearch://ESCU - Okta Phishing Detection with FastPass Origin Check - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies. Okta''s Defensive Cyber Operations team routinely identifies phishing infrastructure configured to imitate an Okta sign-in page and proactively notify Okta customers when suspicious infrastructure we detect appears to be targeting their users. Since March 2020, we have delivered over 1000 notifications to customers.
+how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.001", "T1556"], "nist": ["DE.CM"]}
+known_false_positives = Fidelity of this is high as Okta is specifying malicious infrastructure. Filter and modify as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Okta Risk Threshold Exceeded - Rule]
 type = detection
 asset_type = Infrastructure
@@ -169,6 +212,39 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Deliv
 known_false_positives = False positives should be limited as this is a high fidelity marker.
 providing_technologies = null
 
+[savedsearch://ESCU - Okta Suspicious Use of a Session Cookie - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. \
+* Retrieves policy evaluation events from successful authentication events. \
+* Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. \
+* Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.
+how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1539"], "nist": ["DE.AE"]}
+known_false_positives = False positives may be present based on organization size and configuration of Okta.
+providing_technologies = null
+
+[savedsearch://ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.001", "T1110.004"], "nist": ["DE.CM"]}
+known_false_positives = Fidelity of this is high as it is Okta ThreatInsight. Filter and modify as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.001", "T1110.003"], "nist": ["DE.CM"]}
+known_false_positives = Fidelity of this is high as it is Okta ThreatInsight. Filter and modify as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Okta ThreatInsight Threat Detected - Rule]
 type = detection
 asset_type = Infrastructure
@@ -9205,7 +9281,7 @@ asset_type = Endpoint
 confidence = medium
 explanation = This analytic will identify suspicious files dropped or created in the Windows %startup% folder. This technique is a common way to gain persistence on a targeted host. Threat actor, adversaries and red teamer abuse this folder path to automatically execute their malicious sample upon boot or restart of the infected host. This TTP detection is a good indicator that a suspicious process wants to gain persistence on the targeted host. We suggest to verify the process name by using the process guid field, the file created and also the user and the computer name for further investigation.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
-annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["DE.CM"]}
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["DE.AE"]}
 known_false_positives = Administrators may allow creation of script or exe in this path.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
@@ -9591,7 +9667,7 @@ asset_type = Endpoint
 confidence = medium
 explanation = The following analytic identifies the suspicious child process of calc.exe due to dll side loading technique to execute another executable. This technique was seen in qakbot malware that uses dll side loading technique to calc applications to load its malicious dll code. The malicious dll that abuses dll side loading technique will load the actual qakbot loader dll using regsvr32.exe application. This TTP is a good indicator of qakbot since the calc.exe will not load other child processes aside from win32calc.exe.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Installation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.CM"]}
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Installation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.AE"]}
 known_false_positives = unknown
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
@@ -10618,7 +10694,7 @@ asset_type = Endpoint
 confidence = medium
 explanation = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]}
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1059.001", "T1059", "T1562.001", "T1562"], "nist": ["DE.CM"]}
 known_false_positives = administrators may execute this command that may cause some false positive.
 providing_technologies = ["Microsoft Windows"]
 
@@ -10818,7 +10894,7 @@ asset_type = Endpoint
 confidence = medium
 explanation = The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. In addition, in order to perform this action, the user context will need to be SYSTEM.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1053.005", "T1562"], "nist": ["DE.CM"]}
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1053.005", "T1562"], "nist": ["DE.AE"]}
 known_false_positives = False positives should be limited as the activity is not common to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified or Deleted values based on product that is in the datamodel.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
@@ -10942,6 +11018,26 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = Administrators or power users may use this command for troubleshooting.
 providing_technologies = ["Microsoft Windows"]
 
+[savedsearch://ESCU - Windows Rundll32 WebDAV Request - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. This particular behavior was recently showcased in CVE-2023-23397.
+how_to_implement = In addition to getting the correct data, adding a join with network connection will assist with making this higher fidelity. We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+known_false_positives = False positives will be present based on legitimate software, filtering may need to occur.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Rundll32 WebDav With Network Connection - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. The analytic attempts to use join from Processes and All_Traffic to identify the network connection. This particular behavior was recently showcased in CVE-2023-23397.
+how_to_implement = We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and the All_Traffic Datamodel. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+known_false_positives = False positives will be present based on legitimate software, filtering may need to occur.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Scheduled Task with Highest Privileges - Rule]
 type = detection
 asset_type = Endpoint
@@ -12861,6 +12957,28 @@ searches = ["ESCU - Fortinet Appliance Auth bypass - Rule"]
 description = Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects CVE-2022-40684.
 narrative = FortiOS exposes a management web portal that allows a user configure the system. Additionally, a user can SSH into the system which exposes a locked down CLI interface. Any HTTP requests to the management interface of the system that match the conditions above should be cause for concern. An attacker can use this vulnerability to do just about anything they want to the vulnerable system. This includes changing network configurations, adding new users, and initiating packet captures. Note that this is not the only way to exploit this vulnerability and there may be other sets of conditions that work. For instance, a modified version of this exploit uses the User-Agent Node.js. This exploit seems to follow a trend among recently discovered enterprise software vulnerabilities where HTTP headers are improperly validated or overly trusted. (ref Horizon3.ai)
 
+[analytic_story://CVE-2023-21716 Word RTF Heap Corruption]
+category = Adversary Tactics
+last_updated = 2023-03-10
+version = 1
+references = ["https://www.bleepingcomputer.com/news/security/proof-of-concept-released-for-critical-microsoft-word-rce-bug/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Office Application Drop Executable - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Winword Spawning Windows Script Host - Rule"]
+description = A proof-of-concept for CVE-2023-21716, a critical vulnerability in Microsoft Word that allows remote code execution utilizing a heap corruption in rich text files.
+narrative = This analytic story covers content that will assist organizations in identifying potential RTF RCE abuse on endpoints. The vulnerability was assigned a 9.8 out of 10 severity score, with Microsoft addressing it in the February Patch Tuesday security updates along with a couple of workarounds. Security researcher Joshua Drake last year discovered the vulnerability in Microsoft Office''s "wwlib.dll" and sent Microsoft a technical advisory containing proof-of-concept (PoC) code showing the issue is exploitable. A remote attacker could potentially take advantage of the issue to execute code with the same privileges as the victim that opens a malicious .RTF document. Delivering the malicious file to a victim can be as easy as an attachment to an email, although plenty of other methods exist. Microsoft warns that users don''t have to open a malicious RTF document and simply loading the file in the Preview Pane is enough for the compromise to start. (BleepingComputer, 2023)
+
+[analytic_story://CVE-2023-23397 Outlook Elevation of Privilege]
+category = Adversary Tactics
+last_updated = 2023-03-15
+version = 1
+references = ["https://twitter.com/ACEResponder/status/1636116096506818562?s=20", "https://twitter.com/domchell/status/1635999068282408962?s=20", "https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/", "https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Windows Rundll32 WebDAV Request - Rule", "ESCU - Windows Rundll32 WebDav With Network Connection - Rule"]
+description = Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows.
+narrative = Microsoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.\ CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required.\ The connection to the remote SMB server sends the user''s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication. Online services such as Microsoft 365 do not support NTLM authentication and are not vulnerable to being attacked by these messages. (2023, Microsoft)
+
 [analytic_story://CyclopsBLink]
 category = Malware
 last_updated = 2022-04-07
@@ -13665,7 +13783,7 @@ version = 1
 references = ["https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/", "https://www.csoonline.com/article/3674156/multi-factor-authentication-fatigue-attacks-are-on-the-rise-how-to-defend-against-them.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Okta Account Locked Out - Rule", "ESCU - Okta MFA Exhaustion Hunt - Rule", "ESCU - Okta Risk Threshold Exceeded - Rule", "ESCU - Okta Two or More Rejected Okta Pushes - Rule"]
+searches = ["ESCU - Okta Account Locked Out - Rule", "ESCU - Okta MFA Exhaustion Hunt - Rule", "ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule", "ESCU - Okta Risk Threshold Exceeded - Rule", "ESCU - Okta Two or More Rejected Okta Pushes - Rule"]
 description = A social engineering technique called 'MFA Fatigue', aka 'MFA push spam' or 'MFA Exhaustion', is growing more popular with threat actors as it does not require malware or phishing infrastructure and has proven to be successful in attacks.
 narrative = An MFA Fatigue attack is when a threat actor runs a script that attempts to log in with stolen credentials over and over, causing what feels like an endless stream of MFA push requests to be sent to the account's owner's mobile device. The goal is to keep this up, day and night, to break down the target's cybersecurity posture and inflict a sense of "fatigue" regarding these MFA prompts.
 
@@ -14237,7 +14355,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Locked Out - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta MFA Exhaustion Hunt - Rule", "ESCU - Okta New API Token Created - Rule", "ESCU - Okta New Device Enrolled on Account - Rule", "ESCU - Okta Risk Threshold Exceeded - Rule", "ESCU - Okta Suspicious Activity Reported - Rule", "ESCU - Okta ThreatInsight Threat Detected - Rule", "ESCU - Okta Two or More Rejected Okta Pushes - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"]
+searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Locked Out - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta MFA Exhaustion Hunt - Rule", "ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule", "ESCU - Okta Multiple Failed Requests to Access Applications - Rule", "ESCU - Okta New API Token Created - Rule", "ESCU - Okta New Device Enrolled on Account - Rule", "ESCU - Okta Phishing Detection with FastPass Origin Check - Rule", "ESCU - Okta Risk Threshold Exceeded - Rule", "ESCU - Okta Suspicious Activity Reported - Rule", "ESCU - Okta Suspicious Use of a Session Cookie - Rule", "ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule", "ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule", "ESCU - Okta ThreatInsight Threat Detected - Rule", "ESCU - Okta Two or More Rejected Okta Pushes - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"]
 description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors.
 narrative = Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \
 While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 12368
+build = 12515
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.61.0
+version = 3.62.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-16T08:34:28 UTC
+# On Date: 2023-03-23T09:34:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 3.61.0
+version = 3.62.0

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-16T08:34:28 UTC
+# On Date: 2023-03-23T09:34:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-16T08:34:28 UTC
+# On Date: 2023-03-23T09:34:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -53,6 +53,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[okta_mismatch_between_source_and_response_for_verify_push_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[okta_multiple_failed_requests_to_access_applications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [okta_new_api_token_created_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -61,6 +69,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[okta_phishing_detection_with_fastpass_origin_check_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [okta_risk_threshold_exceeded_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -69,6 +81,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[okta_suspicious_use_of_a_session_cookie_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[okta_threatinsight_login_failure_with_high_unknown_users_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[okta_threatinsight_suspected_passwordspray_attack_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [okta_threatinsight_threat_detected_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4297,6 +4321,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_rundll32_webdav_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_rundll32_webdav_with_network_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_scheduled_task_with_highest_privileges_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

dist/escu/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-16T08:34:28 UTC
+# On Date: 2023-03-23T09:34:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -491,6 +491,122 @@ realtime_schedule = 0
 is_visible = false
 search = `okta` eventType=system.push.send_factor_verify_push OR ((legacyEventType=core.user.factor.attempt_success) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH)) OR ((legacyEventType=core.user.factor.attempt_fail) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH)) | stats count(eval(legacyEventType="core.user.factor.attempt_success")) as successes count(eval(legacyEventType="core.user.factor.attempt_fail")) as failures count(eval(eventType="system.push.send_factor_verify_push")) as pushes by authenticationContext.externalSessionId,user,_time | stats latest(_time) as lasttime earliest(_time) as firsttime sum(successes) as successes sum(failures) as failures sum(pushes) as pushes by authenticationContext.externalSessionId,user | eval seconds=lasttime-firsttime | eval lasttime=strftime(lasttime, "%c") | search (pushes>1) | eval totalattempts=successes+failures | eval finding="Normal authentication pattern" | eval finding=if(failures==pushes AND pushes>1,"Authentication attempts not successful because multiple pushes denied",finding) | eval finding=if(totalattempts==0,"Multiple pushes sent and ignored",finding) | eval finding=if(successes>0 AND pushes>3,"Probably should investigate. Multiple pushes sent, eventual successful authentication!",finding) | where seconds<600 AND finding="Multiple pushes sent, eventual successful authentication!" AND totalattempts > 5 | sort - pushes, totalattempts | `okta_mfa_exhaustion_hunt_filter`
 
+[ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\
+For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \
+Source of Push (Sign-In) \
+eventType eq \"system.push.send_factor_verify_push\" \
+User Push Response (Okta Verify client) \
+eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \
+In sequence, the logic for the analytic - \
+* Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \
+* Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \ * Creates a ratio of successful sign-ins to pushes. \
+* If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\
+For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \
+Source of Push (Sign-In) \
+eventType eq \"system.push.send_factor_verify_push\" \
+User Push Response (Okta Verify client) \
+eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \
+In sequence, the logic for the analytic - \
+* Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \
+* Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \ * Creates a ratio of successful sign-ins to pushes. \
+* If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.
+action.escu.how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+action.escu.known_false_positives = False positives may be present based on organization size and configuration of Okta. Monitor, tune and filter as needed.
+action.escu.creation_date = 2023-03-17
+action.escu.modification_date = 2023-03-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity", "Okta MFA Exhaustion"]
+action.risk = 1
+action.risk.param._risk_message = A mismatch between source and response for verifying a push request has occurred for $actor.alternateId$
+action.risk.param._risk = [{"risk_object_field": "actor.alternateId", "risk_object_type": "user", "risk_score": 64}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity", "Okta MFA Exhaustion"], "cis20": ["CIS 10"], "confidence": 80, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\
+For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \
+Source of Push (Sign-In) \
+eventType eq \"system.push.send_factor_verify_push\" \
+User Push Response (Okta Verify client) \
+eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \
+In sequence, the logic for the analytic - \
+* Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \
+* Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \ * Creates a ratio of successful sign-ins to pushes. \
+* If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.
+action.notable.param.rule_title = Okta Mismatch Between Source and Response for Verify Push Request
+action.notable.param.security_domain = access
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` eventType IN (system.push.send_factor_verify_push) OR (eventType IN (user.authentication.auth_via_mfa) debugContext.debugData.factor="OKTA_VERIFY_PUSH") | eval groupby="authenticationContext.externalSessionId" | eval group_push_time=_time | bin span=2s group_push_time | fillnull value=NULL | stats min(_time) as _time by authenticationContext.externalSessionId eventType debugContext.debugData.factor outcome.result actor.alternateId client.device client.ipAddress client.userAgent.rawUserAgent debugContext.debugData.behaviors group_push_time groupby | iplocation client.ipAddress | fields - lat, lon, group_push_time | stats min(_time) as _time dc(client.ipAddress) as dc_ip sum(eval(if(eventType="system.push.send_factor_verify_push" AND "outcome.result"="SUCCESS",1,0))) as total_pushes sum(eval(if(eventType="user.authentication.auth_via_mfa" AND "outcome.result"="SUCCESS",1,0))) as total_successes sum(eval(if(eventType="user.authentication.auth_via_mfa" AND "outcome.result"="FAILURE",1,0))) as total_rejected sum(eval(if(eventType="system.push.send_factor_verify_push" AND "debugContext.debugData.behaviors" LIKE "%New Device=POSITIVE%",1,0))) as suspect_device_from_source sum(eval(if(eventType="system.push.send_factor_verify_push" AND "debugContext.debugData.behaviors" LIKE "%New IP=POSITIVE%",0,0))) as suspect_ip_from_source values(eval(if(eventType="system.push.send_factor_verify_push","client.ipAddress",""))) as src values(eval(if(eventType="user.authentication.auth_via_mfa","client.ipAddress",""))) as dest values(*) as * by groupby | eval ratio = round(total_successes/total_pushes,2) | search ((ratio < 0.5 AND total_pushes > 1) OR (total_rejected > 0)) AND dc_ip > 1 AND suspect_device_from_source > 0 AND suspect_ip_from_source > 0 | `okta_mismatch_between_source_and_response_for_verify_push_request_filter`
+
+[ESCU - Okta Multiple Failed Requests to Access Applications - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \ * Retrieves policy evaluation and SSO details in events that contain the Application requested \
+* Formats target fields so we can aggregate specifically on Applications (AppInstances) \
+* Groups by User, Session and IP \
+* Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies \
+* Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550.004", "T1538"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \ * Retrieves policy evaluation and SSO details in events that contain the Application requested \
+* Formats target fields so we can aggregate specifically on Applications (AppInstances) \
+* Groups by User, Session and IP \
+* Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies \
+* Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.
+action.escu.how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+action.escu.known_false_positives = False positives may be present based on organization size and configuration of Okta.
+action.escu.creation_date = 2023-03-17
+action.escu.modification_date = 2023-03-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta Multiple Failed Requests to Access Applications - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta Multiple Failed Requests to Access Applications - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 10"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550.004", "T1538"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip('target{}.type', 'target{}.displayName', ": ") | eval targets=mvfilter(targets LIKE "AppInstance%") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType="policy.evaluate_sign_on",targets,NULL))) as total_challenges sum(eval(if(eventType="user.authentication.sso",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if("outcome.result"="SUCCESS",targets,NULL))) as success_apps values(eval(if(":outcome.result"!="SUCCESS",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity="HIGH", mitre_technique_id="T1538", description="actor.alternateId". " from " . "client.ipAddress" . " seen opening " . total_challenges . " chiclets/apps with " . total_successes . " challenges successfully passed" | fields - count, targets | search ratio < 0.5 total_challenges > 2` | okta_multiple_failed_requests_to_access_applications_filter`
+
 [ESCU - Okta New API Token Created - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -577,6 +693,52 @@ realtime_schedule = 0
 is_visible = false
 search = `okta` eventType=system.email.new_device_notification.sent_message displayMessage="Send user new device notification email" | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser client.geographicalContext.city client.geographicalContext.country | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_new_device_enrolled_on_account_filter`
 
+[ESCU - Okta Phishing Detection with FastPass Origin Check - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies. Okta''s Defensive Cyber Operations team routinely identifies phishing infrastructure configured to imitate an Okta sign-in page and proactively notify Okta customers when suspicious infrastructure we detect appears to be targeting their users. Since March 2020, we have delivered over 1000 notifications to customers.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.001", "T1556"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies. Okta''s Defensive Cyber Operations team routinely identifies phishing infrastructure configured to imitate an Okta sign-in page and proactively notify Okta customers when suspicious infrastructure we detect appears to be targeting their users. Since March 2020, we have delivered over 1000 notifications to customers.
+action.escu.how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+action.escu.known_false_positives = Fidelity of this is high as Okta is specifying malicious infrastructure. Filter and modify as needed.
+action.escu.creation_date = 2023-03-09
+action.escu.modification_date = 2023-03-09
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta Phishing Detection with FastPass Origin Check - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity"]
+action.risk = 1
+action.risk.param._risk_message = Okta FastPass has prevented $user$ from authenticating to a malicious site.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta Phishing Detection with FastPass Origin Check - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 10"], "confidence": 100, "impact": 100, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.001", "T1556"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies. Okta''s Defensive Cyber Operations team routinely identifies phishing infrastructure configured to imitate an Okta sign-in page and proactively notify Okta customers when suspicious infrastructure we detect appears to be targeting their users. Since March 2020, we have delivered over 1000 notifications to customers.
+action.notable.param.rule_title = Okta Phishing Detection with FastPass Origin Check
+action.notable.param.security_domain = access
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` eventType="user.authentication.auth_via_mfa" AND result="FAILURE" AND outcome.reason="FastPass declined phishing attempt" | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser outcome.reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_phishing_detection_with_fastpass_origin_check_filter`
+
 [ESCU - Okta Risk Threshold Exceeded - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -664,6 +826,139 @@ realtime_schedule = 0
 is_visible = false
 search = `okta` eventType=user.account.report_suspicious_activity_by_enduser | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser client.geographicalContext.city client.geographicalContext.country | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_suspicious_activity_reported_filter`
 
+[ESCU - Okta Suspicious Use of a Session Cookie - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. \
+* Retrieves policy evaluation events from successful authentication events. \
+* Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. \
+* Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1539"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. \
+* Retrieves policy evaluation events from successful authentication events. \
+* Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. \
+* Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.
+action.escu.how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+action.escu.known_false_positives = False positives may be present based on organization size and configuration of Okta.
+action.escu.creation_date = 2023-03-17
+action.escu.modification_date = 2023-03-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta Suspicious Use of a Session Cookie - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta Suspicious Use of a Session Cookie - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 10"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1539"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` eventType IN (policy.evaluate_sign_on) outcome.result IN (ALLOW, SUCCESS) | stats earliest(_time) as _time values(client.ipAddress) as src_ip values(client.userAgent.rawUserAgent) as user_agent values(client.userAgent.os) as userAgentOS_list values(client.geographicalContext.city) as city values(client.userAgent.browser) as userAgentBrowser_list values(device.os_platform) as okta_device_os dc(client.userAgent.browser) as dc_userAgentBrowser dc(client.userAgent.os) as dc_userAgentOS dc(client.ipAddress) as dc_src_ip values(outcome.reason) as reason by debugContext.debugData.dtHash actor.alternateId | where dc_src_ip>1 AND (dc_userAgentOS>1 OR dc_userAgentBrowser>1) | `okta_suspicious_use_of_a_session_cookie_filter`
+
+[ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.001", "T1110.004"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.escu.how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+action.escu.known_false_positives = Fidelity of this is high as it is Okta ThreatInsight. Filter and modify as needed.
+action.escu.creation_date = 2023-03-09
+action.escu.modification_date = 2023-03-09
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity"]
+action.risk = 1
+action.risk.param._risk_message = Okta ThreatInsight has detected or prevented a high number of login failures.
+action.risk.param._risk = []
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 10"], "confidence": 100, "impact": 50, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.001", "T1110.004"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.notable.param.rule_title = Okta ThreatInsight Login Failure with High Unknown users
+action.notable.param.security_domain = access
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` eventType="security.threat.detected" AND outcome.reason="Login failures with high unknown users count*" | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser outcome.reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_threatinsight_login_failure_with_high_unknown_users_filter`
+
+[ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.001", "T1110.003"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.escu.how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+action.escu.known_false_positives = Fidelity of this is high as it is Okta ThreatInsight. Filter and modify as needed.
+action.escu.creation_date = 2023-03-09
+action.escu.modification_date = 2023-03-09
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity"]
+action.risk = 1
+action.risk.param._risk_message = Okta ThreatInsight has detected or prevented a PasswordSpray attack.
+action.risk.param._risk = []
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 10"], "confidence": 100, "impact": 60, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.001", "T1110.003"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.notable.param.rule_title = Okta ThreatInsight Suspected PasswordSpray Attack
+action.notable.param.security_domain = access
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` eventType="security.threat.detected" AND outcome.reason="Password Spray" | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by eventType client.userAgent.rawUserAgent client.userAgent.browser outcome.reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_threatinsight_suspected_passwordspray_attack_filter`
+
 [ESCU - Okta ThreatInsight Threat Detected - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -1324,7 +1619,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*" AND Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*"AND Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc Search_Activity.search!="*splunk_improperly_formatted_parameter_crashes_splunkd_filter*" Search_Activity.user!=splunk-system-user by Search_Activity.search, Search_Activity.info, Search_Activity.total_run_time, Search_Activity.user, Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`
 
 [ESCU - Splunk list all nonstandard admin accounts - Rule]
 action.escu = 0
@@ -27749,8 +28044,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 action.escu.known_false_positives = quite minimal false positive expected.
-action.escu.creation_date = 2021-07-05
-action.escu.modification_date = 2021-07-05
+action.escu.creation_date = 2023-03-15
+action.escu.modification_date = 2023-03-15
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Msmpeng Application DLL Side Loading - Rule
 action.escu.search_type = detection
@@ -27784,7 +28079,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = |tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll")  AND Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`
+search = |tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll")  AND NOT (Filesystem.file_path IN ("*\\Program Files\\windows defender\\*","*\\WinSxS\\*defender-service*","*\\WinSxS\\Temp\\*defender-service*")) by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`
 
 [ESCU - Net Localgroup Discovery - Rule]
 action.escu = 0
@@ -28293,7 +28588,7 @@ action.escu.full_search_name = ESCU - Office Application Drop Executable - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["FIN7", "AgentTesla"]
+action.escu.analytic_story = ["FIN7", "AgentTesla", "CVE-2023-21716 Word RTF Heap Corruption"]
 action.risk = 1
 action.risk.param._risk_message = process $process_name$ drops a file $file_name$ in host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -28304,7 +28599,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Office Application Drop Executable - Rule
-action.correlationsearch.annotations = {"analytic_story": ["FIN7", "AgentTesla"], "cis20": ["CIS 10"], "confidence": 80, "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["FIN7", "AgentTesla", "CVE-2023-21716 Word RTF Heap Corruption"], "cis20": ["CIS 10"], "confidence": 80, "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -28569,7 +28864,7 @@ action.escu.full_search_name = ESCU - Office Product Spawn CMD Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Trickbot", "DarkCrystal RAT", "Azorult", "Remcos", "Qakbot", "AgentTesla"]
+action.escu.analytic_story = ["Trickbot", "DarkCrystal RAT", "Azorult", "Remcos", "Qakbot", "AgentTesla", "CVE-2023-21716 Word RTF Heap Corruption"]
 action.risk = 1
 action.risk.param._risk_message = an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
@@ -28580,7 +28875,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Office Product Spawn CMD Process - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "DarkCrystal RAT", "Azorult", "Remcos", "Qakbot", "AgentTesla"], "cis20": ["CIS 10"], "confidence": 80, "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "DarkCrystal RAT", "Azorult", "Remcos", "Qakbot", "AgentTesla", "CVE-2023-21716 Word RTF Heap Corruption"], "cis20": ["CIS 10"], "confidence": 80, "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -29360,7 +29655,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`
 
 [ESCU - Potential password in username - Rule]
 action.escu = 0
@@ -34817,8 +35112,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following analytic identifies DLLHost.exe with no command line arguments. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
-action.escu.creation_date = 2022-03-15
-action.escu.modification_date = 2022-03-15
+action.escu.creation_date = 2023-03-08
+action.escu.modification_date = 2023-03-08
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious DLLHost no Command Line Arguments - Rule
 action.escu.search_type = detection
@@ -38809,7 +39104,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 action.escu = 0
 action.escu.enabled = 1
 description = This analytic will identify suspicious files dropped or created in the Windows %startup% folder. This technique is a common way to gain persistence on a targeted host. Threat actor, adversaries and red teamer abuse this folder path to automatically execute their malicious sample upon boot or restart of the infected host. This TTP detection is a good indicator that a suspicious process wants to gain persistence on the targeted host. We suggest to verify the process name by using the process guid field, the file created and also the user and the computer name for further investigation.
-action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["DE.CM"]}
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["DE.AE"]}
 action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This analytic will identify suspicious files dropped or created in the Windows %startup% folder. This technique is a common way to gain persistence on a targeted host. Threat actor, adversaries and red teamer abuse this folder path to automatically execute their malicious sample upon boot or restart of the infected host. This TTP detection is a good indicator that a suspicious process wants to gain persistence on the targeted host. We suggest to verify the process name by using the process guid field, the file created and also the user and the computer name for further investigation.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
@@ -38832,14 +39127,8 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Boot or Logon Autostart Execution In Startup Folder - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Chaos Ransomware"], "cis20": ["CIS 10"], "confidence": 90, "impact": 90, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Chaos Ransomware"], "cis20": ["CIS 10"], "confidence": 90, "impact": 90, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["DE.AE"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic will identify suspicious files dropped or created in the Windows %startup% folder. This technique is a common way to gain persistence on a targeted host. Threat actor, adversaries and red teamer abuse this folder path to automatically execute their malicious sample upon boot or restart of the infected host. This TTP detection is a good indicator that a suspicious process wants to gain persistence on the targeted host. We suggest to verify the process name by using the process guid field, the file created and also the user and the computer name for further investigation.
-action.notable.param.rule_title = Windows Boot or Logon Autostart Execution In Startup Folder
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -40453,7 +40742,7 @@ search = `sysmon` EventCode=7 Image = "*\calc.exe" AND NOT (Image IN ("*:\\windo
 action.escu = 0
 action.escu.enabled = 1
 description = The following analytic identifies the suspicious child process of calc.exe due to dll side loading technique to execute another executable. This technique was seen in qakbot malware that uses dll side loading technique to calc applications to load its malicious dll code. The malicious dll that abuses dll side loading technique will load the actual qakbot loader dll using regsvr32.exe application. This TTP is a good indicator of qakbot since the calc.exe will not load other child processes aside from win32calc.exe.
-action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Installation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.CM"]}
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Installation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.AE"]}
 action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following analytic identifies the suspicious child process of calc.exe due to dll side loading technique to execute another executable. This technique was seen in qakbot malware that uses dll side loading technique to calc applications to load its malicious dll code. The malicious dll that abuses dll side loading technique will load the actual qakbot loader dll using regsvr32.exe application. This TTP is a good indicator of qakbot since the calc.exe will not load other child processes aside from win32calc.exe.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
@@ -40476,14 +40765,8 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows DLL Side-Loading Process Child Of Calc - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Qakbot"], "cis20": ["CIS 10"], "confidence": 90, "impact": 90, "kill_chain_phases": ["Exploitation", "Installation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Qakbot"], "cis20": ["CIS 10"], "confidence": 90, "impact": 90, "kill_chain_phases": ["Exploitation", "Installation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.AE"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic identifies the suspicious child process of calc.exe due to dll side loading technique to execute another executable. This technique was seen in qakbot malware that uses dll side loading technique to calc applications to load its malicious dll code. The malicious dll that abuses dll side loading technique will load the actual qakbot loader dll using regsvr32.exe application. This TTP is a good indicator of qakbot since the calc.exe will not load other child processes aside from win32calc.exe.
-action.notable.param.rule_title = Windows DLL Side-Loading Process Child Of Calc
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -40493,7 +40776,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "calc.exe")  AND Processes.process_name != "win32calc.exe" by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_dll_side_loading_process_child_of_calc_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "calc.exe")  AND Processes.process_name != "win32calc.exe" by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_side_loading_process_child_of_calc_filter`
 
 [ESCU - Windows DotNet Binary in Non Standard Path - Rule]
 action.escu = 0
@@ -44729,7 +45012,7 @@ search = `powershell` EventCode=4104 ScriptBlockText IN("*New-WebGlobalModule*",
 action.escu = 0
 action.escu.enabled = 1
 description = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
-action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]}
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1059.001", "T1059", "T1562.001", "T1562"], "nist": ["DE.CM"]}
 action.escu.data_models = []
 action.escu.eli5 = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -44752,7 +45035,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Powershell Import Applocker Policy - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 10"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 10"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1059.001", "T1059", "T1562.001", "T1562"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -45591,7 +45874,7 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 action.escu = 0
 action.escu.enabled = 1
 description = The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. In addition, in order to perform this action, the user context will need to be SYSTEM.
-action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1053.005", "T1562"], "nist": ["DE.CM"]}
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1053.005", "T1562"], "nist": ["DE.AE"]}
 action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. In addition, in order to perform this action, the user context will need to be SYSTEM.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
@@ -45614,14 +45897,8 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Registry Delete Task SD - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Windows Registry Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 10"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1053.005", "T1562"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Windows Registry Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 10"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1053.005", "T1562"], "nist": ["DE.AE"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. In addition, in order to perform this action, the user context will need to be SYSTEM.
-action.notable.param.rule_title = Windows Registry Delete Task SD
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -46150,6 +46427,98 @@ realtime_schedule = 0
 is_visible = false
 search = `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*.gplink*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_root_domain_linked_policies_discovery_filter`
 
+[ESCU - Windows Rundll32 WebDAV Request - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. This particular behavior was recently showcased in CVE-2023-23397.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. This particular behavior was recently showcased in CVE-2023-23397.
+action.escu.how_to_implement = In addition to getting the correct data, adding a join with network connection will assist with making this higher fidelity. We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be present based on legitimate software, filtering may need to occur.
+action.escu.creation_date = 2023-03-15
+action.escu.modification_date = 2023-03-15
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Rundll32 WebDAV Request - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["CVE-2023-23397 Outlook Elevation of Privilege"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Rundll32 WebDAV Request - Rule
+action.correlationsearch.annotations = {"analytic_story": ["CVE-2023-23397 Outlook Elevation of Privilege"], "cis20": ["CIS 10"], "confidence": 60, "cve": ["CVE-2023-23397"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. This particular behavior was recently showcased in CVE-2023-23397.
+action.notable.param.rule_title = Windows Rundll32 WebDAV Request
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*","*\\windows\\syswow64\\davclnt.dll,*davsetcookie*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rundll32_webdav_request_filter`
+
+[ESCU - Windows Rundll32 WebDav With Network Connection - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. The analytic attempts to use join from Processes and All_Traffic to identify the network connection. This particular behavior was recently showcased in CVE-2023-23397.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint", "Network_Traffic"]
+action.escu.eli5 = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. The analytic attempts to use join from Processes and All_Traffic to identify the network connection. This particular behavior was recently showcased in CVE-2023-23397.
+action.escu.how_to_implement = We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and the All_Traffic Datamodel. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be present based on legitimate software, filtering may need to occur.
+action.escu.creation_date = 2023-03-16
+action.escu.modification_date = 2023-03-16
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Rundll32 WebDav With Network Connection - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["CVE-2023-23397 Outlook Elevation of Privilege"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Rundll32 WebDav With Network Connection - Rule
+action.correlationsearch.annotations = {"analytic_story": ["CVE-2023-23397 Outlook Elevation of Privilege"], "cis20": ["CIS 10"], "confidence": 60, "cve": ["CVE-2023-23397"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. The analytic attempts to use join from Processes and All_Traffic to identify the network connection. This particular behavior was recently showcased in CVE-2023-23397.
+action.notable.param.rule_title = Windows Rundll32 WebDav With Network Connection
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name=svchost.exe `process_rundll32` Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*", "*\\windows\\syswow64\\davclnt.dll,*davsetcookie*") by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename dest as src | join host process_id [ | tstats `security_content_summariesonly` count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port!=0 NOT (All_Traffic.dest_ip IN (10.0.0.0/12, 172.16.0.0/12, 192.168.0.0/16))  by host All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] | `windows_rundll32_webdav_with_network_connection_filter`
+
 [ESCU - Windows Scheduled Task with Highest Privileges - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -48565,7 +48934,7 @@ action.escu.full_search_name = ESCU - Winword Spawning Cmd - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Spearphishing Attachments", "DarkCrystal RAT"]
+action.escu.analytic_story = ["Spearphishing Attachments", "DarkCrystal RAT", "CVE-2023-21716 Word RTF Heap Corruption"]
 action.risk = 1
 action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -48576,7 +48945,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Winword Spawning Cmd - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "DarkCrystal RAT"], "cis20": ["CIS 10"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "DarkCrystal RAT", "CVE-2023-21716 Word RTF Heap Corruption"], "cis20": ["CIS 10"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -48611,7 +48980,7 @@ action.escu.full_search_name = ESCU - Winword Spawning PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Spearphishing Attachments", "DarkCrystal RAT"]
+action.escu.analytic_story = ["Spearphishing Attachments", "DarkCrystal RAT", "CVE-2023-21716 Word RTF Heap Corruption"]
 action.risk = 1
 action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -48622,7 +48991,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Winword Spawning PowerShell - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "DarkCrystal RAT"], "cis20": ["CIS 10"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "DarkCrystal RAT", "CVE-2023-21716 Word RTF Heap Corruption"], "cis20": ["CIS 10"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -48657,7 +49026,7 @@ action.escu.full_search_name = ESCU - Winword Spawning Windows Script Host - Rul
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Spearphishing Attachments"]
+action.escu.analytic_story = ["Spearphishing Attachments", "CVE-2023-21716 Word RTF Heap Corruption"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ on $dest$ spawned Windows Script Host from Winword.exe
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -48668,7 +49037,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Winword Spawning Windows Script Host - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 10"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "CVE-2023-21716 Word RTF Heap Corruption"], "cis20": ["CIS 10"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-16T08:34:28 UTC
+# On Date: 2023-03-23T09:34:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -342,6 +342,7 @@ min_matches = 1
 [ransomware_notes_lookup]
 filename = ransomware_notes.csv
 default_match = false
+case_sensitive_match = false
 # description = A list of file names that are ransomware note files
 match_type = WILDCARD(ransomware_notes)
 min_matches = 1

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-16T08:34:28 UTC
+# On Date: 2023-03-23T09:34:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/lookups/ransomware_extensions.csv

@@ -299,3 +299,4 @@ Extensions,Name
 .MILIHPEN,Milihpen
 .GANGBANG,Gangbang
 .reddot,RedDot
+.MEDUSA,Medusa

dist/escu/lookups/ransomware_notes.csv

@@ -69,4 +69,6 @@ MILIHPEN-INSTRUCT.txt,True
 GANGBANG-NOTE.txt,True
 GET_YOUR_FILES_BACK.txt,True
 read_it.txt,True
-*.README.txt, True
+*.README.txt, True
+*READ_ME_MEDUSA*.TXT,True
+How_to_back_files.HTML,True

lookups/ransomware_extensions.csv

@@ -299,3 +299,4 @@ Extensions,Name
 .MILIHPEN,Milihpen
 .GANGBANG,Gangbang
 .reddot,RedDot
+.MEDUSA,Medusa

lookups/ransomware_notes.csv

@@ -69,4 +69,6 @@ MILIHPEN-INSTRUCT.txt,True
 GANGBANG-NOTE.txt,True
 GET_YOUR_FILES_BACK.txt,True
 read_it.txt,True
-*.README.txt, True
+*.README.txt, True
+*READ_ME_MEDUSA*.TXT,True
+How_to_back_files.HTML,True

lookups/ransomware_notes_lookup.yml

@@ -4,3 +4,4 @@ filename: ransomware_notes.csv
 match_type: WILDCARD(ransomware_notes)
 min_matches: 1
 name: ransomware_notes_lookup
+case_sensitive_match: 'false'

playbooks/CrowdStrike_OAuth_API_Device_Attribute_Lookup.yml

@@ -1,15 +1,15 @@
-name: Crowdstrike OAuth API Device Attribute Lookup
+name: CrowdStrike OAuth API Device Attribute Lookup
 id: fc0eac01-af2b-4cb0-7b4d-63da67d3fe74
 version: 1
 date: '2023-01-11'
 author: Teoderick Contreras, Splunk
 type: Investigation
 description: "Accepts a user or device and looks up the most recent attributes and groups for that user or device. This playbook produces a normalized output for each user and device."
-playbook: Crowdstrike_OAuth_API_Device_Attribute_Lookup
+playbook: CrowdStrike_OAuth_API_Device_Attribute_Lookup
 how_to_implement: This input playbook requires the Crowdstrike OAuth API connector to be configured. It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style. 
 references: []
 app_list: 
-  - Crowdstrike OAuth API
+  - CrowdStrike OAuth API
 tags:
   platform_tags:
     - attributes 
@@ -22,4 +22,4 @@ tags:
   vpe_type: Modern
   playbook_fields: []
   product:
-  - Splunk SOAR
+  - Splunk SOAR

stories/cve_2023_21716_word_rtf_heap_corruption.yml

@@ -0,0 +1,23 @@
+name: CVE-2023-21716 Word RTF Heap Corruption
+id: b1aeaf2c-8496-42e7-b2f7-15c328bc75d9
+version: 1
+date: '2023-03-10'
+author: Michael Haag, Splunk
+description: A proof-of-concept for CVE-2023-21716, a critical vulnerability in Microsoft Word that allows remote code execution utilizing a heap corruption in rich text files.
+narrative: This analytic story covers content that will assist organizations in identifying potential RTF RCE abuse on endpoints.
+  The vulnerability was assigned a 9.8 out of 10 severity score, with Microsoft addressing it in the February Patch Tuesday security updates along with a couple of workarounds. 
+  Security researcher Joshua Drake last year discovered the vulnerability in Microsoft Office''s "wwlib.dll" and sent Microsoft a technical advisory containing proof-of-concept (PoC) code showing the issue is exploitable.
+  A remote attacker could potentially take advantage of the issue to execute code with the same privileges as the victim that opens a malicious .RTF document.
+  Delivering the malicious file to a victim can be as easy as an attachment to an email, although plenty of other methods exist.
+  Microsoft warns that users don''t have to open a malicious RTF document and simply loading the file in the Preview Pane is enough for the compromise to start. (BleepingComputer, 2023) 
+references:
+  - https://www.bleepingcomputer.com/news/security/proof-of-concept-released-for-critical-microsoft-word-rce-bug/ 
+tags:
+  analytic_story: CVE-2023-21716 Word RTF Heap Corruption
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/cve_2023_23397_outlook_elevation_of_privilege.yml

@@ -0,0 +1,23 @@
+name: CVE-2023-23397 Outlook Elevation of Privilege
+id: b459911b-551f-480f-a402-18cf89ca1e9c
+version: 1
+date: '2023-03-15'
+author: Michael Haag, Splunk
+description: Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. 
+narrative: Microsoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.\
+  CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required.\
+  The connection to the remote SMB server sends the user''s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication. Online services such as Microsoft 365 do not support NTLM authentication and are not vulnerable to being attacked by these messages. (2023, Microsoft)
+references:
+  - https://twitter.com/ACEResponder/status/1636116096506818562?s=20
+  - https://twitter.com/domchell/status/1635999068282408962?s=20
+  - https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
+  - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
+tags:
+  analytic_story: CVE-2023-23397 Outlook Elevation of Privilege
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection