From e0bdf82ff32db0e11e72c62323fa9e1b64b0353b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 28 Jul 2022 13:37:50 -0600
Subject: [PATCH 01/21] Fix

https://splunk.atlassian.net/browse/TR-2308
---
 ...ows_hunting_system_account_targeting_lsass.yml | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml
index dc42cb5d08..369fcff49c 100644
--- a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml
+++ b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml
@@ -17,9 +17,9 @@ search: '`sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) a
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
+  Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required. 
 known_false_positives: False positives will occur based on GrantedAccess and SourceUser,
-  filter based on source image as needed.
+  filter based on source image as needed. Utilize this hunting analytic to tune out false positives in TTP or anomaly analytics.
 references:
 - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
 - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
@@ -39,8 +39,7 @@ tags:
   impact: 80
   kill_chain_phases:
   - Actions on Objectives
-  message: A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related
-    to credential dumping on $dest$. Review for further details.
+  message: A process, $SourceImage$, has requested access to LSASS on $dest$. Review for further details.
   mitre_attack_id:
   - T1003.001
   - T1003
@@ -48,18 +47,10 @@ tags:
   - DE.AE
   - DE.CM
   observable:
-  - name: user
-    type: User
-    role:
-    - Victim
   - name: dest
     type: Hostname
     role:
     - Victim
-  - name: ImageLoaded
-    type: Process
-    role:
-    - Other
   - name: SourceImage
     type: Process
     role:

From bcb5aab4eed2ed3d7954aa8fffbba96ed6079c1a Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 29 Jul 2022 10:06:40 +0200
Subject: [PATCH 02/21] dcrat-analytics3

---
 ..._gather_victim_host_information_camera.yml | 65 +++++++++++++++++++
 ...er_victim_host_information_camera.test.yml | 13 ++++
 2 files changed, 78 insertions(+)
 create mode 100644 detections/endpoint/windows_gather_victim_host_information_camera.yml
 create mode 100644 tests/endpoint/windows_gather_victim_host_information_camera.test.yml

diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml
new file mode 100644
index 0000000000..022ce44500
--- /dev/null
+++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml
@@ -0,0 +1,65 @@
+name: Windows Gather Victim Host Information Camera
+id: e4df4676-ea41-4397-b160-3ee0140dc332
+version: 1
+date: '2022-07-28'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: UPDATE_DESCRIPTION
+search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText IN ("*PNPClass = 'Image'*", "*PNPClass = 'Camera'*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_gather_victim_host_information_camera_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: admin may execute this powershell command to get hardware information related to camera.
+references:
+- https://cert.gov.ua/article/405538
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat
+- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
+tags:
+  analytic_story:
+  - DarkCrystal RAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml.log
+  impact: 60
+  kill_chain_phases:
+  - Reconnaissance
+  message: powershell script $ScriptBlockText$ to enumerate camera in $Computer$
+  mitre_attack_id:
+  - T1592.001
+  - T1592
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Computer
+  - EventCode
+  risk_score: 42
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_gather_victim_host_information_camera.test.yml b/tests/endpoint/windows_gather_victim_host_information_camera.test.yml
new file mode 100644
index 0000000000..b93ff23971
--- /dev/null
+++ b/tests/endpoint/windows_gather_victim_host_information_camera.test.yml
@@ -0,0 +1,13 @@
+name: Windows Gather Victim Host Information Camera Unit Test
+tests:
+- name: Windows Gather Victim Host Information Camera
+  file: endpoint/windows_gather_victim_host_information_camera.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell-xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From a0336d013a34dcf2565f85b4ebffe8a25164349b Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 29 Jul 2022 10:12:22 +0200
Subject: [PATCH 03/21] dcrat-analytics3

---
 .../endpoint/windows_gather_victim_host_information_camera.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml
index 022ce44500..42c18734d4 100644
--- a/detections/endpoint/windows_gather_victim_host_information_camera.yml
+++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml
@@ -7,7 +7,7 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: UPDATE_DESCRIPTION
-search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText IN ("*PNPClass = 'Image'*", "*PNPClass = 'Camera'*")
+search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText = "*PNPClass*" ScriptBlockText IN ("*Image*", "*Camera*")
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`

From 8ad83a0b5f8c948508b7482f5400b2ae2c1541ef Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 29 Jul 2022 11:17:19 -0600
Subject: [PATCH 04/21] Haag It

Linux Curl Upload File
Linux Ingress Tool Transfer Hunting
Linux Ingress Tool Transfer with Curl
Linux Proxy Socks Curl
---
 .../endpoint/linux_curl_upload_file.yml       | 81 ++++++++++++++++++
 .../linux_ingress_tool_transfer_hunting.yml   | 80 ++++++++++++++++++
 .../linux_ingress_tool_transfer_with_curl.yml | 82 ++++++++++++++++++
 .../endpoint/linux_proxy_socks_curl.yml       | 84 +++++++++++++++++++
 .../endpoint/linux_curl_upload_file.test.yml  | 13 +++
 ...nux_ingress_tool_transfer_hunting.test.yml | 13 +++
 ...x_ingress_tool_transfer_with_curl.test.yml | 13 +++
 .../endpoint/linux_proxy_socks_curl.test.yml  | 13 +++
 8 files changed, 379 insertions(+)
 create mode 100644 detections/endpoint/linux_curl_upload_file.yml
 create mode 100644 detections/endpoint/linux_ingress_tool_transfer_hunting.yml
 create mode 100644 detections/endpoint/linux_ingress_tool_transfer_with_curl.yml
 create mode 100644 detections/endpoint/linux_proxy_socks_curl.yml
 create mode 100644 tests/endpoint/linux_curl_upload_file.test.yml
 create mode 100644 tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml
 create mode 100644 tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml
 create mode 100644 tests/endpoint/linux_proxy_socks_curl.test.yml

diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml
new file mode 100644
index 0000000000..f3bcadd123
--- /dev/null
+++ b/detections/endpoint/linux_curl_upload_file.yml
@@ -0,0 +1,81 @@
+name: Linux Curl Upload File
+id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf
+version: 1
+date: '2022-07-29'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies curl being utilized with the -F or --form, --upload-file, -T, -d, --data, --data-raw, -I and --head switches to upload AWS credentials or config to a remote destination.
+  This enables uploading of binary files and so forth. To force the 'content' part to be a file, prefix the file name with an @ sign. To just get the content part from a file, prefix the file name with the symbol <. The difference between @ and < is then that @ makes a file get attached in the post as a file upload, while the < makes a text field and just get the contents for that text field from a file.
+  This technique was utlized by the TeamTNT group to exfiltrate AWS credentials.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl
+  Processes.process IN ("*-F *", "*--form *","*--upload-file *","*-T *","*-d *","*--data *","*--data-raw *", "*-I *", "*--head *") AND Processes.process IN ("*.aws/credentials*". "*.aws/config*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `linux_curl_upload_file_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: Filtering may be required. In addition to AWS credentials, add other important files and monitor. The inverse would be to look for _all_ -F behavior and tune from there.
+references:
+  - https://curl.se/docs/manpage.html
+  - https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/
+  - https://gtfobins.github.io/gtfobins/curl/
+tags:
+  analytic_story:
+  - Linux Living Off The Land
+  - Data Exfiltration
+  - Ingress Tool Transfer
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to upload important files to a remote destination.
+  mitre_attack_id:
+  - T1105
+  nist:
+  - DE.CM
+  observable:
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
new file mode 100644
index 0000000000..191d9ceed8
--- /dev/null
+++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
@@ -0,0 +1,80 @@
+name: Linux Ingress Tool Transfer Hunting
+id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf
+version: 1
+date: '2022-07-29'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic hunts for curl and wget being utilized in the environment. This is meant to help with identifying normal usage and potentially malicious. Utilize this query to tune other curl and wget analytics. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=curl OR Processes.process_name=wget) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `linux_ingress_tool_transfer_hunting_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be present. This query is meant to help tune other curl and wget analytics.
+references:
+  - https://gtfobins.github.io/gtfobins/curl/
+  - https://curl.se/docs/manpage.html#-I
+  - https://gtfobins.github.io/gtfobins/curl/
+  - https://github.com/rapid7/metasploit-framework/search?q=curl
+tags:
+  analytic_story:
+  - Linux Living Off The Land
+  - Ingress Tool Transfer
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 0
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
+  impact: 0
+  kill_chain_phases:
+  - Delivery
+  - Installation
+  - Actions on Objectives
+  message: An instance of $process_name$ was identified
+    on endpoint $dest$ by user $user$ utilizing curl or wget.
+  mitre_attack_id:
+  - T1105
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 0
+  security_domain: endpoint
diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml
new file mode 100644
index 0000000000..7a8f04c92a
--- /dev/null
+++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml
@@ -0,0 +1,82 @@
+name: Linux Ingress Tool Transfer with Curl
+id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857
+version: 1
+date: '2022-07-29'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies curl with the command-line switches that are commonly used to download, output, a remote script or binary. 
+  MetaSploit Framework will combine the -sO switch with | chmod +x to enable a simple one liner to download and set the execute bit to run the file immediately.
+  During triage, review the remote domain and file being downloaded for legitimacy. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl 
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | where match(process, "(?i)(-O|-sO|-ksO|--output)") 
+  | `linux_ingress_tool_transfer_with_curl_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be present. Tune and then change type to TTP.
+references:
+  - https://gtfobins.github.io/gtfobins/curl/
+  - https://curl.se/docs/manpage.html#-I
+  - https://gtfobins.github.io/gtfobins/curl/
+  - https://github.com/rapid7/metasploit-framework/search?q=curl
+tags:
+  analytic_story:
+  - Linux Living Off The Land
+  - Ingress Tool Transfer
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
+  impact: 40
+  kill_chain_phases:
+  - Delivery
+  message: An instance of $process_name$ was identified
+    on endpoint $dest$ by user $user$ to download a remote file. Review activity for further details.
+  mitre_attack_id:
+  - T1105
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 12
+  security_domain: endpoint
diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml
new file mode 100644
index 0000000000..202091a466
--- /dev/null
+++ b/detections/endpoint/linux_proxy_socks_curl.yml
@@ -0,0 +1,84 @@
+name: Linux Proxy Socks Curl
+id: bd596c22-ad1e-44fc-b242-817253ce8b08
+version: 1
+date: '2022-07-29'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies curl being utilized with a proxy based on command-line arguments - -x, socks, --preproxy and --proxy. This behavior is built into the MetaSploit Framework as a auxiliary module. What does socks buy an adversary? 
+  SOCKS4a extends the SOCKS4 protocol to allow a client to specify a destination domain name rather than an IP address.
+  The SOCKS5 protocol is defined in RFC 1928. It is an incompatible extension of the SOCKS4 protocol; it offers more choices for authentication and adds support for IPv6 and UDP, the latter of which can be used for DNS lookups.
+  The protocols, and a proxy itself, allow an adversary to evade controls in place monitoring traffic, making it harder for the defender to identify and track activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl
+  Processes.process IN ("*-x *", "*socks4a://*", "*socks5h://*", "*socks4://*","*socks5://*", "*--preproxy *", "--proxy*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `linux_proxy_socks_curl_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present based on proxy usage internally. Filter as needed.
+references:
+  - https://www.offensive-security.com/metasploit-unleashed/proxytunnels/
+  - https://curl.se/docs/manpage.html
+  - https://en.wikipedia.org/wiki/SOCKS
+  - https://oxylabs.io/blog/curl-with-proxy
+  - https://reqbin.com/req/c-ddxflki5/curl-proxy-server#:~:text=To%20use%20a%20proxy%20with,be%20URL%20decoded%20by%20Curl.
+  - https://gtfobins.github.io/gtfobins/curl/
+tags:
+  analytic_story:
+  - Linux Living Off The Land
+  - Ingress Tool Transfer
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Delivery
+  message: An instance of $process_name$ was identified
+    on endpoint $dest$ by user $user$ utilizing a proxy. Review activity for further details.
+  mitre_attack_id:
+  - T1090
+  - T1095
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/linux_curl_upload_file.test.yml b/tests/endpoint/linux_curl_upload_file.test.yml
new file mode 100644
index 0000000000..4115fcb1df
--- /dev/null
+++ b/tests/endpoint/linux_curl_upload_file.test.yml
@@ -0,0 +1,13 @@
+name: Linux Curl Upload File Unit Test
+tests:
+- name: Linux Curl Upload File
+  file: endpoint/linux_curl_upload_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: curl-linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml b/tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml
new file mode 100644
index 0000000000..b97f8b97dc
--- /dev/null
+++ b/tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml
@@ -0,0 +1,13 @@
+name: Linux Ingress Tool Transfer Hunting Unit Test
+tests:
+- name: Linux Ingress Tool Transfer Hunting
+  file: endpoint/linux_ingress_tool_transfer_hunting.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: curl-linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml b/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml
new file mode 100644
index 0000000000..2683732440
--- /dev/null
+++ b/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml
@@ -0,0 +1,13 @@
+name: Linux Ingress Tool Transfer With Curl Unit Test
+tests:
+- name: Linux Ingress Tool Transfer With Curl
+  file: endpoint/linux_ingress_tool_transfer_with_curl.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: curl-linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/linux_proxy_socks_curl.test.yml b/tests/endpoint/linux_proxy_socks_curl.test.yml
new file mode 100644
index 0000000000..615cefef18
--- /dev/null
+++ b/tests/endpoint/linux_proxy_socks_curl.test.yml
@@ -0,0 +1,13 @@
+name: Linux Proxy Socks Curl Unit Test
+tests:
+- name: Linux Proxy Socks Curl
+  file: endpoint/linux_proxy_socks_curl.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: curl-linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true
\ No newline at end of file

From 978e4c3ef7b62e313cf0fa6180eaad7422906c8b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 29 Jul 2022 11:19:42 -0600
Subject: [PATCH 05/21] Update linux_ingress_tool_transfer_hunting.yml

fixed risk
---
 detections/endpoint/linux_ingress_tool_transfer_hunting.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
index 191d9ceed8..2883bb7b68 100644
--- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
+++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
@@ -30,12 +30,12 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
-  confidence: 0
+  confidence: 10
   context:
   - Source:Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
-  impact: 0
+  impact: 10
   kill_chain_phases:
   - Delivery
   - Installation
@@ -76,5 +76,5 @@ tags:
   - Processes.parent_process_path
   - Processes.process_path
   - Processes.parent_process_id
-  risk_score: 0
+  risk_score: 1
   security_domain: endpoint

From 8bc3086675a970f259fdafdb88bdd16670bdc83b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 29 Jul 2022 17:39:55 -0600
Subject: [PATCH 06/21] iscsicpl

---
 ...l_search_order_hijacking_with_iscsicpl.yml | 84 +++++++++++++++++++
 ...rch_order_hijacking_with_iscsicpl.test.yml | 13 +++
 2 files changed, 97 insertions(+)
 create mode 100644 detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
 create mode 100644 tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml

diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
new file mode 100644
index 0000000000..40376d92dd
--- /dev/null
+++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
@@ -0,0 +1,84 @@
+name: Windows DLL Search Order Hijacking with iscsicpl
+id: f39ee679-3b1e-4f47-841c-5c3c580acda2
+version: 1
+date: '2022-07-29'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a recently disclosed search ordler DLL hijack in iscsicpl.exe. The malicious DLL must be in a new path and iscsicpl.exe, upon load, will execute the payload. The analytic is restricted to Windows shells.
+  Two proof of concepts were identified and utilized to determine the behavior. The command-line is an option to go after, but most likely identifying a child process off iscsicpl.exe will be more effective. Monitoring for suspicious DLL loads is also an option.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=iscsicpl.exe
+  `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `windows_dll_search_order_hijacking_with_iscsicpl_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present, filtering may be required. Remove the Windows Shells macro to determine if other utilities are using iscsicpl.exe.
+references:
+  - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC
+  - https://github.com/422926799/csplugin/tree/master/bypassUAC
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Inbound
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsi-windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to elevate access.
+  mitre_attack_id:
+  - T1574.001
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml b/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml
new file mode 100644
index 0000000000..5a75853806
--- /dev/null
+++ b/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml
@@ -0,0 +1,13 @@
+name: Windows DLL Search Order Hijacking with iscsicpl Unit Test
+tests:
+- name: Windows DLL Search Order Hijacking with iscsicpl
+  file: endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: iscsi-windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsi-windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From bbd4b67e9d4a459c6f4ba3f86760f0b3aacec2bb Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Sat, 30 Jul 2022 06:02:04 -0600
Subject: [PATCH 07/21] fixed query

modified query to use NOT instead of !=
---
 .../endpoint/windows_non_system_account_targeting_lsass.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml
index 1ad65699a6..bc9eda222e 100644
--- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml
+++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml
@@ -1,7 +1,7 @@
 name: Windows Non-System Account Targeting Lsass
 id: b1ce9a72-73cf-11ec-981b-acde48001122
-version: 1
-date: '2022-01-12'
+version: 2
+date: '2022-07-30'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -10,7 +10,7 @@ description: The following analytic identifies non SYSTEM accounts requesting ac
   requiring access to credentials. Triaging this event will require understanding
   the GrantedAccess from the SourceImage. In addition, whether the account is privileged
   or not. Review the process requesting permissions and review parallel processes.
-search: '`sysmon` EventCode=10 TargetImage=*lsass.exe SourceUser!="NT AUTHORITY\\*"
+search: '`sysmon` EventCode=10 TargetImage=*lsass.exe NOT (SourceUser="NT AUTHORITY\\*")
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage,
   GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer
   as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`

From b67f2c69a1934aedab1a155748f51ca30c4d74cc Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 1 Aug 2022 14:15:02 +0200
Subject: [PATCH 08/21] dcrat-analytics3

---
 ...gress_tool_transfer_using_explorer_exe.yml | 73 +++++++++++++++++++
 ..._tool_transfer_using_explorer_exe.test.yml | 13 ++++
 2 files changed, 86 insertions(+)
 create mode 100644 detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml
 create mode 100644 tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml

diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml
new file mode 100644
index 0000000000..5e572dd2ed
--- /dev/null
+++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml
@@ -0,0 +1,73 @@
+name: Windows Ingress Tool Transfer Using Explorer.exe
+id: 76753bab-f116-4ea3-8fb9-89b638be58a9
+version: 1
+date: '2022-08-01'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic detects a explorer.exe with possible url link process commandline on it. 
+  Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. 
+  So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application 
+  in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
+  which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name = explorer.exe OR Processes.original_file_name = explorer.exe) AND NOT (Processes.parent_process_name IN("userinit.exe", "svchost.exe")) Processes.process IN ("* http://*", "* https://*")
+  by  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id Processes.dest Processes.user
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_ingress_tool_transfer_using_explorer_exe_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
+tags:
+  analytic_story:
+  - DarkCrystal RAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: a explorer process with url link $process$ in $dest$
+  mitre_attack_id:
+  - T1105
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 25
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml b/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml
new file mode 100644
index 0000000000..15994d4375
--- /dev/null
+++ b/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml
@@ -0,0 +1,13 @@
+name: Windows Ingress Tool Transfer Using Explorer.exe Unit Test
+tests:
+- name: Windows Ingress Tool Transfer Using Explorer.exe
+  file: endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From d8690a438605d2838a14e9ba10a3bab9efc9e531 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 1 Aug 2022 14:18:20 +0200
Subject: [PATCH 09/21] Update
 windows_ingress_tool_transfer_using_explorer_exe.yml

---
 .../windows_ingress_tool_transfer_using_explorer_exe.yml      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml
index 5e572dd2ed..fd22ac46ff 100644
--- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml
+++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml
@@ -1,4 +1,4 @@
-name: Windows Ingress Tool Transfer Using Explorer.exe
+name: Windows Ingress Tool Transfer Using Explorer
 id: 76753bab-f116-4ea3-8fb9-89b638be58a9
 version: 1
 date: '2022-08-01'
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
-  | `windows_ingress_tool_transfer_using_explorer_exe_filter`'
+  | `windows_ingress_tool_transfer_using_explorer_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

From 7ef8d1dadf40725b81e950a1a543686309be4883 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 1 Aug 2022 14:18:38 +0200
Subject: [PATCH 10/21] Update
 windows_ingress_tool_transfer_using_explorer_exe.test.yml

---
 ...indows_ingress_tool_transfer_using_explorer_exe.test.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml b/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml
index 15994d4375..a88a8dbade 100644
--- a/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml
+++ b/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml
@@ -1,7 +1,7 @@
-name: Windows Ingress Tool Transfer Using Explorer.exe Unit Test
+name: Windows Ingress Tool Transfer Using Explorer Unit Test
 tests:
-- name: Windows Ingress Tool Transfer Using Explorer.exe
-  file: endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml
+- name: Windows Ingress Tool Transfer Using Explorer
+  file: endpoint/windows_ingress_tool_transfer_using_explorer.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now

From f3f40edf9ea173dbe6aa2e1e9674a5b6ec7f476d Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 1 Aug 2022 14:22:03 +0200
Subject: [PATCH 11/21] Update
 windows_gather_victim_host_information_camera.yml

---
 .../windows_gather_victim_host_information_camera.yml        | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml
index 42c18734d4..91b8e08d25 100644
--- a/detections/endpoint/windows_gather_victim_host_information_camera.yml
+++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml
@@ -6,7 +6,10 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: UPDATE_DESCRIPTION
+description: The following analytic detects a powershell script that enumerate camera mounted to the targeted host. 
+  This technique was seen in DCRat malware, where it runs a powershell command to look for camera information that will be pass on to its
+  C2 server. This anomaly detection can be a good pivot to check who and why this enumeration is needed and what parent process execute this powershell
+  script command.
 search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText = "*PNPClass*" ScriptBlockText IN ("*Image*", "*Camera*")
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
   | `security_content_ctime(firstTime)` 

From 44517188c19a82a9c86ed9bdb1f95d1780cfe0a0 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 1 Aug 2022 14:22:35 +0200
Subject: [PATCH 12/21] Rename
 windows_ingress_tool_transfer_using_explorer_exe.test.yml to
 windows_ingress_tool_transfer_using_explorer.test.yml

---
 ....yml => windows_ingress_tool_transfer_using_explorer.test.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename tests/endpoint/{windows_ingress_tool_transfer_using_explorer_exe.test.yml => windows_ingress_tool_transfer_using_explorer.test.yml} (100%)

diff --git a/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml b/tests/endpoint/windows_ingress_tool_transfer_using_explorer.test.yml
similarity index 100%
rename from tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml
rename to tests/endpoint/windows_ingress_tool_transfer_using_explorer.test.yml

From 2df3a64798fc0af17c8a602d40ea3202736c9f16 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 1 Aug 2022 14:23:01 +0200
Subject: [PATCH 13/21] Rename
 windows_ingress_tool_transfer_using_explorer_exe.yml to
 windows_ingress_tool_transfer_using_explorer.yml

---
 ...r_exe.yml => windows_ingress_tool_transfer_using_explorer.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename detections/endpoint/{windows_ingress_tool_transfer_using_explorer_exe.yml => windows_ingress_tool_transfer_using_explorer.yml} (100%)

diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
similarity index 100%
rename from detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml
rename to detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml

From 0fc18fcbdb2560f1f7fcd59e9483e9d92a63a1be Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 1 Aug 2022 17:34:21 +0200
Subject: [PATCH 14/21] dcrat-analytics3

---
 .../endpoint/scheduled_task_deleted_or_created_via_cmd.yml       | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
index cc5a66a67f..4ef0b987f3 100644
--- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
@@ -32,6 +32,7 @@ tags:
   - Windows Persistence Techniques
   - Living Off The Land
   - Azorult
+  - DarkCrystal RAT
   asset_type: Endpoint
   cis20:
   - CIS 3

From e189299cf2a0539bba0580dbcac1df533a3b03c6 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Tue, 2 Aug 2022 12:00:40 +0200
Subject: [PATCH 15/21] dcrat-analytics3

---
 .../endpoint/suspicious_scheduled_task_from_public_directory.yml | 1 +
 .../winevent_windows_task_scheduler_event_action_started.yml     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
index 2b5dad1423..0e7ba9a82f 100644
--- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
@@ -33,6 +33,7 @@ tags:
   - Windows Persistence Techniques
   - Living Off The Land
   - Azorult
+  - DarkCrystal RAT
   confidence: 50
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
index a021bdb930..6741d19efd 100644
--- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
@@ -32,6 +32,7 @@ tags:
   - IcedID
   - Windows Persistence Techniques
   - Industroyer2
+  - DarkCrystal RAT
   confidence: 100
   context:
   - Source:Endpoint

From da230f6ed6e6bb05b15eea88e4e4ed421dda5d78 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Tue, 2 Aug 2022 13:31:49 +0200
Subject: [PATCH 16/21] dcrat-analytics3

---
 detections/endpoint/windows_system_logoff_commandline.yml   | 2 +-
 detections/endpoint/windows_system_reboot_commandline.yml   | 2 +-
 detections/endpoint/windows_system_shutdown_commandline.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml
index f1bd6ed549..49e9cc206b 100644
--- a/detections/endpoint/windows_system_logoff_commandline.yml
+++ b/detections/endpoint/windows_system_logoff_commandline.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies Windows commandlined to logoff a windows host machine. 
+description: The following analytic identifies Windows commandline to logoff a windows host machine. 
   This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, 
   interrupt access, aid destruction of the system like wiping disk or inhibit system recovery.
   This TTP is a good pivot to check why application trigger this commandline which is not so common way to logoff a machine.
diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml
index 55ed3995c9..59663bc318 100644
--- a/detections/endpoint/windows_system_reboot_commandline.yml
+++ b/detections/endpoint/windows_system_reboot_commandline.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies Windows commandlined to reboot a windows host machine. 
+description: The following analytic identifies Windows commandline to reboot a windows host machine. 
   This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, 
   interrupt access, aid destruction of the system like wiping disk or inhibit system recovery.
   This TTP is a good pivot to check why application trigger this commandline which is not so common way to reboot a machine.
diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml
index 9374e4c8d5..e240068959 100644
--- a/detections/endpoint/windows_system_shutdown_commandline.yml
+++ b/detections/endpoint/windows_system_shutdown_commandline.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies Windows commandlined to shutdown a windows host machine. 
+description: The following analytic identifies Windows commandline to shutdown a windows host machine. 
   This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, 
   interrupt access, aid destruction of the system like wiping disk or inhibit system recovery.
   This TTP is a good pivot to check why application trigger this commandline which is not so common way to shutdown a machine.

From 9cfa2151e7d85fa122a980a93f4f9a4624f92438 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 Aug 2022 14:01:38 +0200
Subject: [PATCH 17/21] Update windows_ingress_tool_transfer_using_explorer.yml

---
 .../endpoint/windows_ingress_tool_transfer_using_explorer.yml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
index fd22ac46ff..abe6e5a514 100644
--- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
+++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic detects a explorer.exe with possible url link process commandline on it. 
+description: The following analytic detects an explorer.exe with a possible url link process command line on it.
   Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. 
   So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application 
   in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 

From 83e57921ad1965de55c213183246fbe61303a556 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 2 Aug 2022 08:35:54 -0600
Subject: [PATCH 18/21] iscsi fix

---
 .../windows_dll_search_order_hijacking_with_iscsicpl.yml      | 2 +-
 .../windows_dll_search_order_hijacking_with_iscsicpl.test.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
index 40376d92dd..9f979a5927 100644
--- a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
+++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
@@ -37,7 +37,7 @@ tags:
   - Stage:Defense Evasion
   - Scope:Inbound
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsi-windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log
   impact: 80
   kill_chain_phases:
   - Exploitation
diff --git a/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml b/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml
index 5a75853806..01d93d02f7 100644
--- a/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml
+++ b/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: iscsi-windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsi-windows-sysmon.log
+  - file_name: iscsicpl-windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
     update_timestamp: true

From ca11a32aeb5bffa72212cb2a5dc84901d233589c Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 3 Aug 2022 17:53:06 +0200
Subject: [PATCH 19/21] dcrat-analytics3

---
 .../windows_command_shell_dcrat_forkbomb_payload.yml     | 9 +++++----
 .../endpoint/windows_system_logoff_commandline.yml       | 9 +++++----
 .../endpoint/windows_system_reboot_commandline.yml       | 9 +++++----
 .../endpoint/windows_system_shutdown_commandline.yml     | 9 +++++----
 .../windows_system_time_discovery_w32tm_delay.yml        | 9 +++++----
 5 files changed, 25 insertions(+), 20 deletions(-)

diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml
index 0616c2a06c..ce95cfe5c2 100644
--- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml
+++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml
@@ -19,10 +19,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_command_shell_dcrat_forkbomb_payload_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: unknown
 references:
 - https://cert.gov.ua/article/405538
diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml
index 49e9cc206b..64ebf29e2f 100644
--- a/detections/endpoint/windows_system_logoff_commandline.yml
+++ b/detections/endpoint/windows_system_logoff_commandline.yml
@@ -17,10 +17,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_system_logoff_commandline_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Administrator may execute this commandline to trigger shutdown, logoff or restart the host machine.
 references:
 - https://attack.mitre.org/techniques/T1529/
diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml
index 59663bc318..cec5d5495e 100644
--- a/detections/endpoint/windows_system_reboot_commandline.yml
+++ b/detections/endpoint/windows_system_reboot_commandline.yml
@@ -18,10 +18,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_system_reboot_commandline_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine.
 references:
 - https://attack.mitre.org/techniques/T1529/
diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml
index e240068959..8e75acc197 100644
--- a/detections/endpoint/windows_system_shutdown_commandline.yml
+++ b/detections/endpoint/windows_system_shutdown_commandline.yml
@@ -17,10 +17,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_system_shutdown_commandline_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine.
 references:
 - https://attack.mitre.org/techniques/T1529/
diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml
index bc9a0438ae..6dfc9073d0 100644
--- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml
+++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml
@@ -19,10 +19,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_system_time_discovery_w32tm_delay_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: unknown
 references:
 - https://cert.gov.ua/article/405538

From 7422fb3edae8a9d75e413eed88dec5dfda5319ab Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 4 Aug 2022 09:44:22 +0200
Subject: [PATCH 20/21] dcrat-analytics3

---
 .../windows_ingress_tool_transfer_using_explorer.yml     | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
index abe6e5a514..7866b9324f 100644
--- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
+++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
@@ -18,10 +18,11 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_ingress_tool_transfer_using_explorer_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: unknown
 references:
 - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor

From a192bac909d124e0547d88eba1b28130f7571faa Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 11 Aug 2022 11:13:41 -0700
Subject: [PATCH 21/21] Update
 windows_gather_victim_host_information_camera.yml

---
 .../endpoint/windows_gather_victim_host_information_camera.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml
index 91b8e08d25..6b7741af67 100644
--- a/detections/endpoint/windows_gather_victim_host_information_camera.yml
+++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml
@@ -18,7 +18,7 @@ search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" Scri
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: admin may execute this powershell command to get hardware information related to camera.
+known_false_positives: Administrators may execute this powershell command to get hardware information related to camera.
 references:
 - https://cert.gov.ua/article/405538
 - https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat