Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2022-03-15 09:57:02 -07:00
parent 7aaf975e0c afd49d8c1b
commit 8f19c1faea
68 changed files with 1220 additions and 115 deletions
@@ -187,12 +187,10 @@ def generate_escu_app(persist_security_content: bool = False) -> str:
                    ". ./.venv/bin/activate",
                    "python -m pip install wheel",
                    "python -m pip install -r requirements.txt",
-                    "python contentctl.py --path . --verbose generate --product ESCU --output dist/escu",
-                    "tar -czf DA-ESS-ContentUpdate.spl -C dist/escu ."]
+                    "python3 contentctl.py --path . generate --product ESCU --output dist/escu"]
    else:
        commands = [". ./.venv/bin/activate",
-                    "python contentctl.py --path . --verbose generate --product ESCU --output dist/escu",
-                    "tar -czf DA-ESS-ContentUpdate.spl -C dist/escu ."]
+                    "python3 contentctl.py --path . generate --product ESCU --output dist/escu"]
    ret = subprocess.run("; ".join(commands),
                         shell=True, capture_output=True)
    if ret.returncode != 0:
@@ -200,6 +198,13 @@ def generate_escu_app(persist_security_content: bool = False) -> str:
            ret.stderr))
        sys.exit(1)

+    ret = subprocess.run("tar -czf DA-ESS-ContentUpdate.spl -C dist/escu .",
+                         shell=True, capture_output=True)
+    if ret.returncode != 0:
+        print("Error generating new content.\n\tQuitting and dumping error...\n[%s]" % (
+            ret.stderr))
+        sys.exit(1)
+
    output_file_name = "DA-ESS-ContentUpdate-latest.tar.gz"
    output_file_path_from_slim_latest = os.path.join(
        "upload", output_file_name)
@@ -13,6 +13,8 @@ description: The following search identifies the modification of registry relate
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR"
  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig"
+  OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR"
+  OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig"
  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
  Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
  Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
@@ -0,0 +1,82 @@
+name: Windows Disable Change Password Through Registry
+id: 0df33e1a-9ef6-11ec-a1ad-acde48001122
+version: 1
+date: '2022-03-08'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious registry modification to disable change password feature of the windows host. 
+  This registry modification may disables the Change Password button on the Windows Security dialog box (which appears when you press Ctrl+Alt+Del). 
+  As a result, users cannot change their Windows password on demand. This technique was seen in some malware family like ransomware to prevent the user to change the password 
+  after ownning the network or a system during attack. This windows feature may implemented by administrator to prevent normal user to change the password of 
+  a critical host or server, In this type of scenario filter is needed to minimized false positive.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword"
+  Registry.registry_value_data = "0x00000001"
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data 
+  | `windows_disable_change_password_through_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+known_false_positives: This windows feature may implemented by administrator to prevent normal user to change the password of 
+  a critical host or server, In this type of scenario filter is needed to minimized false positive.
+references:
+-  https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah
+tags:
+  analytic_story:
+  - Ransomware
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
+  - Processes.process_id 
+  - Processes.process_name
+  - Processes.process 
+  - Processes.dest 
+  - Processes.parent_process_name 
+  - Processes.parent_process
+  - Processes.process_guid 
+  security_domain: endpoint
+  impact: 70
+  confidence: 70 
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Registry modification in "DisableChangePassword" on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  asset_type: Endpoint
@@ -0,0 +1,80 @@
+name: Windows Disable Lock Workstation Feature Through Registry
+id: c82adbc6-9f00-11ec-a81f-acde48001122
+version: 1
+date: '2022-03-08'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious registry modification to disable Lock Computer windows features. 
+  This registry modification prevent the user from locking its screen or computer that are being abused by several malware for example ransomware. 
+  This technique was used by threat actor to make its payload more impactful to the compromised host.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation"
+  Registry.registry_value_data = "0x00000001"
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data 
+  | `windows_disable_lock_workstation_feature_through_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+known_false_positives: unknown
+references:
+-  https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/
+-  https://heimdalsecurity.com/blog/fatalrat-targets-telegram/
+tags:
+  analytic_story:
+  - Ransomware
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
+  - Processes.process_id 
+  - Processes.process_name
+  - Processes.process 
+  - Processes.dest 
+  - Processes.parent_process_name 
+  - Processes.parent_process
+  - Processes.process_guid 
+  security_domain: endpoint
+  impact: 70
+  confidence: 70 
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Registry modification in "DisableLockWorkstation" on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  asset_type: Endpoint
@@ -0,0 +1,86 @@
+name: Windows Disable LogOff Button Through Registry
+id: b2fb6830-9ed1-11ec-9fcb-acde48001122
+version: 1
+date: '2022-03-08'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious registry modification to disable logoff feature in windows host. 
+  This registry when enable will prevent users to log off of the system by using any method, 
+  including programs run from the command line, such as scripts. It also disables or removes 
+  all menu items and buttons that log the user off of the system. This technique was seen abused by ransomware malware 
+  to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect.
+  This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
+  and users that can modify this registry is needed.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" 
+  Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff")
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data
+  | `windows_disable_logoff_button_through_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
+  and users that can modify this registry is needed.
+references:
+- https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774
+- https://malwiki.org/index.php?title=DigiPop.xp
+- https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2
+tags:
+  analytic_story:
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
+  - Processes.process_id 
+  - Processes.process_name
+  - Processes.process 
+  - Processes.dest 
+  - Processes.parent_process_name 
+  - Processes.parent_process
+  - Processes.process_guid 
+  security_domain: endpoint
+  impact: 70
+  confidence: 70 
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Registry modification in "NoLogOff" on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  asset_type: Endpoint
@@ -0,0 +1,78 @@
+name: Windows Disable Notification Center
+id: 1cd983c8-8fd6-11ec-a09d-acde48001122
+version: 1
+date: '2022-02-17'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following search identifies a modification of registry to disable
+  the windows notification center feature in a windows host machine. This registry modification removes 
+  notification and action center from the notification area on the task bar. 
+  This modification are seen in RAT malware to cover their tracks upon
+  downloading other of its component or other payload.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_value_name= "DisableNotificationCenter"
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
+  as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `windows_disable_notification_center_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: admin or user may choose to disable this windows features.
+references:
+-  https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_nam
+  security_domain: endpoint
+  impact: 60
+  confidence: 80 
+  # (impact * confidence)/100
+  risk_score: 48
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Windows notification center was disabled on $dest$ by $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - PR.PT
+  - DE.CM
+  cis20:
+  - CIS 8
+  asset_type: Endpoint
@@ -0,0 +1,82 @@
+name: Windows Disable Shutdown Button Through Registry
+id: 55fb2958-9ecd-11ec-a06a-acde48001122
+version: 1
+date: '2022-03-08'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious registry modification to disable shutdown button on the logon user. 
+  This technique was seen in several malware especially in ransomware family like killdisk malware variant to make the compromised host 
+  un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. 
+  This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
+  and users that can modify this registry is needed.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon"
+  Registry.registry_value_data = "0x00000000") 
+  OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001") 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data
+  | `windows_disable_shutdown_button_through_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
+  and users that can modify this registry is needed.
+references:
+-  https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/
+tags:
+  analytic_story:
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
+  - Processes.process_id 
+  - Processes.process_name
+  - Processes.process 
+  - Processes.dest 
+  - Processes.parent_process_name 
+  - Processes.parent_process
+  - Processes.process_guid 
+  security_domain: endpoint
+  impact: 70
+  confidence: 70 
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Registry modification in "shutdownwithoutlogon" on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  asset_type: Endpoint
@@ -0,0 +1,84 @@
+name: Windows Disable Windows Group Policy Features Through Registry
+id: 63a449ae-9f04-11ec-945e-acde48001122
+version: 1
+date: '2022-03-08'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious registry modification to disable windows features. 
+  These techniques are seen in several ransomware malware to impair the compromised host to make it hard for analyst to mitigate or response 
+  from the attack. Disabling these known features make the analysis and forensic response more hard. Disabling these feature is not so common but 
+  can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*"
+  Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", 
+  "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments")
+  Registry.registry_value_data = "0x00000001" 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data 
+  | `windows_disable_windows_group_policy_features_through_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+known_false_positives: unknown
+references:
+- https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en
+- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis
+- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details
+tags:
+  analytic_story:
+  - Ransomware
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
+  - Processes.process_id 
+  - Processes.process_name
+  - Processes.process 
+  - Processes.dest 
+  - Processes.parent_process_name 
+  - Processes.parent_process
+  - Processes.process_guid 
+  security_domain: endpoint
+  impact: 70
+  confidence: 70 
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Registry modification to disable windows features on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  asset_type: Endpoint
@@ -0,0 +1,80 @@
+name: Windows Hide Notification Features Through Registry
+id: cafa4bce-9f06-11ec-a7b2-acde48001122
+version: 1
+date: '2022-03-08'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious registry modification to hide common windows notification feature from compromised host. 
+  This technique was seen in some ransomware family to add more impact to its payload that are visually seen by user aside from the encrypted files and 
+  ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" 
+  Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume")
+  Registry.registry_value_data = "0x00000001" 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data 
+  | `windows_hide_notification_features_through_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+known_false_positives: unknown
+references:
+-  https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/
+tags:
+  analytic_story:
+  - Ransomware
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
+  - Processes.process_id 
+  - Processes.process_name
+  - Processes.process 
+  - Processes.dest 
+  - Processes.parent_process_name 
+  - Processes.parent_process
+  - Processes.process_guid 
+  security_domain: endpoint
+  impact: 70
+  confidence: 70 
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Registry modification to hide windows notification on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  asset_type: Endpoint
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -4414,6 +4414,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1037",
 known_false_positives = unknown
 providing_technologies = []

+[savedsearch://ESCU - MacOS LOLbin - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = Detect multiple executions of Living off the Land (LOLbin) binaries in a short period of time.
+how_to_implement = This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059.004", "T1059"], "nist": ["DE.CM"]}
+known_false_positives = None identified.
+providing_technologies = []
+
 [savedsearch://ESCU - Mailsniper Invoke functions - Rule]
 type = detection
 asset_type = Endpoint
@@ -6801,6 +6811,36 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00
 known_false_positives = admin or user may choose to use this windows features.
 providing_technologies = []

+[savedsearch://ESCU - Windows Disable Change Password Through Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic is to detect a suspicious registry modification to disable change password feature of the windows host. This registry modification may disables the Change Password button on the Windows Security dialog box (which appears when you press Ctrl+Alt+Del). As a result, users cannot change their Windows password on demand. This technique was seen in some malware family like ransomware to prevent the user to change the password after ownning the network or a system during attack. This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive.
+providing_technologies = []
+
+[savedsearch://ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic is to detect a suspicious registry modification to disable Lock Computer windows features. This registry modification prevent the user from locking its screen or computer that are being abused by several malware for example ransomware. This technique was used by threat actor to make its payload more impactful to the compromised host.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
+[savedsearch://ESCU - Windows Disable LogOff Button Through Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic is to detect a suspicious registry modification to disable logoff feature in windows host. This registry when enable will prevent users to log off of the system by using any method, including programs run from the command line, such as scripts. It also disables or removes all menu items and buttons that log the user off of the system. This technique was seen abused by ransomware malware to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows Disable Memory Crash Dump - Rule]
 type = detection
 asset_type = Endpoint
@@ -6811,6 +6851,36 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = unknown
 providing_technologies = []

+[savedsearch://ESCU - Windows Disable Notification Center - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following search identifies a modification of registry to disable the windows notification center feature in a windows host machine. This registry modification removes notification and action center from the notification area on the task bar. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["PR.PT", "DE.CM"]}
+known_false_positives = admin or user may choose to disable this windows features.
+providing_technologies = []
+
+[savedsearch://ESCU - Windows Disable Shutdown Button Through Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic is to detect a suspicious registry modification to disable shutdown button on the logon user. This technique was seen in several malware especially in ransomware family like killdisk malware variant to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic is to detect a suspicious registry modification to disable windows features. These techniques are seen in several ransomware malware to impair the compromised host to make it hard for analyst to mitigate or response from the attack. Disabling these known features make the analysis and forensic response more hard. Disabling these feature is not so common but can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Windows DisableAntiSpyware Registry - Rule]
 type = detection
 asset_type = Endpoint
@@ -6901,6 +6971,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = Unknown at this point
 providing_technologies = []

+[savedsearch://ESCU - Windows Hide Notification Features Through Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic is to detect a suspicious registry modification to hide common windows notification feature from compromised host. This technique was seen in some ransomware family to add more impact to its payload that are visually seen by user aside from the encrypted files and ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Windows High File Deletion Frequency - Rule]
 type = detection
 asset_type = Endpoint
@@ -8774,7 +8854,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = []
+searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
 narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\
 Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists.
@@ -9320,7 +9400,7 @@ version = 1
 references = ["https://lolbas-project.github.io/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
 spec_version = 3
-searches = ["ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - WSReset UAC Bypass - Rule"]
+searches = ["ESCU - Eventvwr UAC Bypass - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - WSReset UAC Bypass - Rule"]
 description = Leverage searches that allow you to search for the presence of an attacker leveraging existing tooling within your environment.
 narrative = Living Off The Land refers to an attacker methodology of using software already installed on their target host to achieve their goals. Many utilities that ship with Windows can be used to achieve various goals, with reduced chances of detection by an antivirus software.

@@ -9561,7 +9641,7 @@ version = 1
 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"]
+searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
 narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.

@@ -10067,7 +10147,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:43 UTC
+# On Date: 2022-03-15T15:18:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1733,6 +1733,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[macos_lolbin_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [mailsniper_invoke_functions_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2657,10 +2661,34 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_disable_change_password_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disable_lock_workstation_feature_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disable_logoff_button_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_disable_memory_crash_dump_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_disable_notification_center_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disable_shutdown_button_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disable_windows_group_policy_features_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_disableantispyware_registry_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2697,6 +2725,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_hide_notification_features_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_high_file_deletion_frequency_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3506,6 +3538,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = eventtype=okta_log
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

+[osquery]
+definition = sourcetype=osquery:results
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [osquery_process]
 definition = eventtype="osquery-process"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -141,8 +141,8 @@ action.escu.data_models = []
 action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
 action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
-action.escu.creation_date = 2021-07-19
-action.escu.modification_date = 2021-07-19
+action.escu.creation_date = 2022-03-03
+action.escu.modification_date = 2022-03-03
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS CreateAccessKey - Rule
 action.escu.search_type = detection
@@ -170,7 +170,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success| search userIdentity.userName!=requestParameters.userName  |  stats count min(_time) as firstTime max(_time) as lastTime  by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter`
+search = `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0) | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`aws_createaccesskey_filter`

 [ESCU - AWS CreateLoginProfile - Rule]
 action.escu = 0
@@ -1069,8 +1069,8 @@ action.escu.data_models = []
 action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
 action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
-action.escu.creation_date = 2021-07-19
-action.escu.modification_date = 2021-07-19
+action.escu.creation_date = 2022-03-03
+action.escu.modification_date = 2022-03-03
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS UpdateLoginProfile - Rule
 action.escu.search_type = detection
@@ -1104,7 +1104,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success| search userIdentity.userName!=requestParameters.userName  |  stats count min(_time) as firstTime max(_time) as lastTime  by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`
+search =  `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success | eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0) | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_updateloginprofile_filter`

 [ESCU - Circle CI Disable Security Job - Rule]
 action.escu = 0
@@ -3382,7 +3382,7 @@ action.escu.full_search_name = ESCU - Clients Connecting to Multiple DNS Servers
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["DNS Hijacking", "Command \u0026 Control", "Suspicious DNS Traffic", "Host Redirection"]
+action.escu.analytic_story = ["DNS Hijacking", "Suspicious DNS Traffic", "Host Redirection", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}]
@@ -3393,7 +3393,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Deprecated - Clients Connecting to Multiple DNS Servers - Rule
-action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking", "Command \u0026 Control", "Suspicious DNS Traffic", "Host Redirection"], "cis20": ["CIS 9", "CIS 12", "CIS 13"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "PR.DS"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
+action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking", "Suspicious DNS Traffic", "Host Redirection", "Command and Control"], "cis20": ["CIS 9", "CIS 12", "CIS 13"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "PR.DS"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
@@ -3610,7 +3610,7 @@ action.escu.full_search_name = ESCU - Detect Long DNS TXT Record Response - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious DNS Traffic", "Command \u0026 Control"]
+action.escu.analytic_story = ["Suspicious DNS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}]
@@ -3621,7 +3621,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Deprecated - Detect Long DNS TXT Record Response - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command \u0026 Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
@@ -4004,7 +4004,7 @@ action.escu.full_search_name = ESCU - Detection of DNS Tunnels - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Data Protection", "Suspicious DNS Traffic", "Command \u0026 Control"]
+action.escu.analytic_story = ["Data Protection", "Suspicious DNS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}]
@@ -4015,7 +4015,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Deprecated - Detection of DNS Tunnels - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Suspicious DNS Traffic", "Command \u0026 Control"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
@@ -4051,7 +4051,7 @@ action.escu.full_search_name = ESCU - DNS Query Requests Resolved by Unauthorize
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["DNS Hijacking", "Command \u0026 Control", "Suspicious DNS Traffic", "Host Redirection"]
+action.escu.analytic_story = ["DNS Hijacking", "Suspicious DNS Traffic", "Host Redirection", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}]
@@ -4062,7 +4062,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Deprecated - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule
-action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking", "Command \u0026 Control", "Suspicious DNS Traffic", "Host Redirection"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
+action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking", "Suspicious DNS Traffic", "Host Redirection", "Command and Control"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
@@ -12530,7 +12530,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `disabling_systemrestore_in_registry_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `disabling_systemrestore_in_registry_filter`

 [ESCU - Disabling Task Manager - Rule]
 action.escu = 0
@@ -12640,7 +12640,7 @@ action.escu.full_search_name = ESCU - DNS Exfiltration Using Nslookup App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command \u0026 Control", "Data Exfiltration"]
+action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Data Exfiltration", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -12651,7 +12651,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - DNS Exfiltration Using Nslookup App - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command \u0026 Control", "Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Data Exfiltration", "Command and Control"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
@@ -14132,7 +14132,7 @@ action.escu.full_search_name = ESCU - Excessive Usage of NSLOOKUP App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command \u0026 Control", "Data Exfiltration"]
+action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Data Exfiltration", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold
 action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 28}]
@@ -14143,7 +14143,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Excessive Usage of NSLOOKUP App - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command \u0026 Control", "Data Exfiltration"], "confidence": 70, "context": ["Source:Endpoint", "Scope:Local", "Stage:Exfiltration"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Data Exfiltration", "Command and Control"], "confidence": 70, "context": ["Source:Endpoint", "Scope:Local", "Stage:Exfiltration"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -18858,6 +18858,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter`

+[ESCU - MacOS LOLbin - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = Detect multiple executions of Living off the Land (LOLbin) binaries in a short period of time.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059.004", "T1059"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = Detect multiple executions of Living off the Land (LOLbin) binaries in a short period of time.
+action.escu.how_to_implement = This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+action.escu.known_false_positives = None identified.
+action.escu.creation_date = 2022-03-04
+action.escu.modification_date = 2022-03-04
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - MacOS LOLbin - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = Multiplle LOLbin are executed on host $host$ by user $user$
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "process", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - MacOS LOLbin - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059.004", "T1059"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = []
+action.notable.param.rule_description = Detect multiple executions of Living off the Land (LOLbin) binaries in a short period of time.
+action.notable.param.rule_title = MacOS LOLbin
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `osquery` name=es_process_events columns.cmdline IN ("find*", "crontab*", "screencapture*", "openssl*", "curl*", "wget*", "killall*", "funzip*") | rename columns.* as * | stats  min(_time) as firstTime max(_time) as lastTime values(cmdline) as cmdline, values(pid) as pid, values(parent) as parent, values(path) as path, values(signing_id) as signing_id,  dc(path) as dc_path by username host | rename username as User, cmdline as process, path as process_path | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `macos_lolbin_filter`
+
 [ESCU - Mailsniper Invoke functions - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -29392,6 +29438,126 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_defender_exclusion_registry_entry_filter`

+[ESCU - Windows Disable Change Password Through Registry - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This analytic is to detect a suspicious registry modification to disable change password feature of the windows host. This registry modification may disables the Change Password button on the Windows Security dialog box (which appears when you press Ctrl+Alt+Del). As a result, users cannot change their Windows password on demand. This technique was seen in some malware family like ransomware to prevent the user to change the password after ownning the network or a system during attack. This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = This analytic is to detect a suspicious registry modification to disable change password feature of the windows host. This registry modification may disables the Change Password button on the Windows Security dialog box (which appears when you press Ctrl+Alt+Del). As a result, users cannot change their Windows password on demand. This technique was seen in some malware family like ransomware to prevent the user to change the password after ownning the network or a system during attack. This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+action.escu.known_false_positives = This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive.
+action.escu.creation_date = 2022-03-08
+action.escu.modification_date = 2022-03-08
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Disable Change Password Through Registry - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Ransomware", "Windows Defense Evasion Tactics"]
+action.risk = 1
+action.risk.param._risk_message = Registry modification in "DisableChangePassword" on $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Disable Change Password Through Registry - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_change_password_through_registry_filter`
+
+[ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This analytic is to detect a suspicious registry modification to disable Lock Computer windows features. This registry modification prevent the user from locking its screen or computer that are being abused by several malware for example ransomware. This technique was used by threat actor to make its payload more impactful to the compromised host.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = This analytic is to detect a suspicious registry modification to disable Lock Computer windows features. This registry modification prevent the user from locking its screen or computer that are being abused by several malware for example ransomware. This technique was used by threat actor to make its payload more impactful to the compromised host.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2022-03-08
+action.escu.modification_date = 2022-03-08
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Ransomware", "Windows Defense Evasion Tactics"]
+action.risk = 1
+action.risk.param._risk_message = Registry modification in "DisableLockWorkstation" on $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_lock_workstation_feature_through_registry_filter`
+
+[ESCU - Windows Disable LogOff Button Through Registry - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This analytic is to detect a suspicious registry modification to disable logoff feature in windows host. This registry when enable will prevent users to log off of the system by using any method, including programs run from the command line, such as scripts. It also disables or removes all menu items and buttons that log the user off of the system. This technique was seen abused by ransomware malware to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = This analytic is to detect a suspicious registry modification to disable logoff feature in windows host. This registry when enable will prevent users to log off of the system by using any method, including programs run from the command line, such as scripts. It also disables or removes all menu items and buttons that log the user off of the system. This technique was seen abused by ransomware malware to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+action.escu.known_false_positives = This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
+action.escu.creation_date = 2022-03-08
+action.escu.modification_date = 2022-03-08
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Disable LogOff Button Through Registry - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Ransomware"]
+action.risk = 1
+action.risk.param._risk_message = Registry modification in "NoLogOff" on $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Disable LogOff Button Through Registry - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_logoff_button_through_registry_filter`
+
 [ESCU - Windows Disable Memory Crash Dump - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -29438,6 +29604,126 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled") AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name  | `drop_dm_object_name(Registry)` |join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`  | fields _time dest user parent_process_name parent_process process_name process_path process process_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process process_guid registry_path registry_value_name registry_value_data registry_key_name | `windows_disable_memory_crash_dump_filter`

+[ESCU - Windows Disable Notification Center - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following search identifies a modification of registry to disable the windows notification center feature in a windows host machine. This registry modification removes notification and action center from the notification area on the task bar. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload.
+action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["PR.PT", "DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following search identifies a modification of registry to disable the windows notification center feature in a windows host machine. This registry modification removes notification and action center from the notification area on the task bar. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = admin or user may choose to disable this windows features.
+action.escu.creation_date = 2022-02-17
+action.escu.modification_date = 2022-02-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Disable Notification Center - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
+action.risk = 1
+action.risk.param._risk_message = The Windows notification center was disabled on $dest$ by $user$.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Disable Notification Center - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_value_name= "DisableNotificationCenter" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `windows_disable_notification_center_filter`
+
+[ESCU - Windows Disable Shutdown Button Through Registry - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This analytic is to detect a suspicious registry modification to disable shutdown button on the logon user. This technique was seen in several malware especially in ransomware family like killdisk malware variant to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = This analytic is to detect a suspicious registry modification to disable shutdown button on the logon user. This technique was seen in several malware especially in ransomware family like killdisk malware variant to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+action.escu.known_false_positives = This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
+action.escu.creation_date = 2022-03-08
+action.escu.modification_date = 2022-03-08
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Disable Shutdown Button Through Registry - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Ransomware"]
+action.risk = 1
+action.risk.param._risk_message = Registry modification in "shutdownwithoutlogon" on $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Disable Shutdown Button Through Registry - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_shutdown_button_through_registry_filter`
+
+[ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This analytic is to detect a suspicious registry modification to disable windows features. These techniques are seen in several ransomware malware to impair the compromised host to make it hard for analyst to mitigate or response from the attack. Disabling these known features make the analysis and forensic response more hard. Disabling these feature is not so common but can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = This analytic is to detect a suspicious registry modification to disable windows features. These techniques are seen in several ransomware malware to impair the compromised host to make it hard for analyst to mitigate or response from the attack. Disabling these known features make the analysis and forensic response more hard. Disabling these feature is not so common but can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2022-03-08
+action.escu.modification_date = 2022-03-08
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Ransomware", "Windows Defense Evasion Tactics"]
+action.risk = 1
+action.risk.param._risk_message = Registry modification to disable windows features on $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_windows_group_policy_features_through_registry_filter`
+
 [ESCU - Windows DisableAntiSpyware Registry - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -29840,6 +30126,46 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*") by _time span=5m Filesystem.dest Filesystem.user Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.file_create_time | `drop_dm_object_name(Filesystem)` | rex field="file_name" "\.(?<extension>[^\.]*$)" | where isnull(extension) | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=5m Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)`] | stats count min(_time) as firstTime max(_time) as lastTime by dest process_name process_guid file_name file_path file_create_time user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_without_extension_in_critical_folder_filter`

+[ESCU - Windows Hide Notification Features Through Registry - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This analytic is to detect a suspicious registry modification to hide common windows notification feature from compromised host. This technique was seen in some ransomware family to add more impact to its payload that are visually seen by user aside from the encrypted files and ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = This analytic is to detect a suspicious registry modification to hide common windows notification feature from compromised host. This technique was seen in some ransomware family to add more impact to its payload that are visually seen by user aside from the encrypted files and ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2022-03-08
+action.escu.modification_date = 2022-03-08
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Hide Notification Features Through Registry - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Ransomware", "Windows Defense Evasion Tactics"]
+action.risk = 1
+action.risk.param._risk_message = Registry modification to hide windows notification on $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Hide Notification Features Through Registry - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_hide_notification_features_through_registry_filter`
+
 [ESCU - Windows High File Deletion Frequency - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -33058,7 +33384,7 @@ action.escu.full_search_name = ESCU - Detect Spike in blocked Outbound Traffic f
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command \u0026 Control"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
@@ -33069,7 +33395,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule
-action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command \u0026 Control"], "cis20": ["CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives", "Command \u0026 Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"], "cis20": ["CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions on Objectives", "Command \u0026 Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -35029,7 +35355,7 @@ action.escu.full_search_name = ESCU - Detect Large Outbound ICMP Packets - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command \u0026 Control"]
+action.escu.analytic_story = ["Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
@@ -35040,7 +35366,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Large Outbound ICMP Packets - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Command \u0026 Control"], "cis20": ["CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1095"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Command and Control"], "cis20": ["CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1095"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
@@ -35541,7 +35867,7 @@ action.escu.full_search_name = ESCU - DNS Query Length Outliers - MLTK - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command \u0026 Control"]
+action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
@@ -35552,7 +35878,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - DNS Query Length Outliers - MLTK - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command \u0026 Control"], "cis20": ["CIS 8", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -35581,7 +35907,7 @@ action.escu.full_search_name = ESCU - Excessive DNS Failures - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious DNS Traffic", "Command \u0026 Control"]
+action.escu.analytic_story = ["Suspicious DNS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"threat_object_field": "dest", "threat_object_type": "other"}]
@@ -35592,7 +35918,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Excessive DNS Failures - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command \u0026 Control"], "cis20": ["CIS 8", "CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -35701,7 +36027,7 @@ action.escu.full_search_name = ESCU - Prohibited Network Traffic Allowed - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command \u0026 Control"]
+action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
@@ -35712,7 +36038,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Prohibited Network Traffic Allowed - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command \u0026 Control"], "cis20": ["CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery", "Command \u0026 Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery", "Command \u0026 Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
@@ -35747,7 +36073,7 @@ action.escu.full_search_name = ESCU - Protocol or Port Mismatch - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Command \u0026 Control"]
+action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
@@ -35758,7 +36084,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Protocol or Port Mismatch - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Command \u0026 Control"], "cis20": ["CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["DE.AE", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["DE.AE", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -36002,7 +36328,7 @@ action.escu.full_search_name = ESCU - TOR Traffic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command \u0026 Control", "NOBELIUM Group"]
+action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "NOBELIUM Group", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
@@ -36013,7 +36339,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - TOR Traffic - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command \u0026 Control", "NOBELIUM Group"], "cis20": ["CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071", "T1071.001"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "NOBELIUM Group", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071", "T1071.001"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
@@ -36370,7 +36696,7 @@ action.escu.full_search_name = ESCU - Detect hosts connecting to dynamic domain
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command \u0026 Control"]
+action.escu.analytic_story = ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = A dns query $query$ from your infra connecting to suspicious domain in host  $host$
 action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 56}]
@@ -36381,7 +36707,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect hosts connecting to dynamic domain providers - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command \u0026 Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1189"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1189"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
@@ -36456,7 +36782,7 @@ action.escu.full_search_name = ESCU - DNS Query Length With High Standard Deviat
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command \u0026 Control"]
+action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = A dns query $query$ with 2 time standard deviation of name len of the dns query in host  $host$
 action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 56}]
@@ -36467,7 +36793,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - DNS Query Length With High Standard Deviation - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command \u0026 Control"], "cis20": ["CIS 8", "CIS 12"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -36496,7 +36822,7 @@ action.escu.full_search_name = ESCU - Multiple Archive Files Http Post Traffic -
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command \u0026 Control", "Data Exfiltration"]
+action.escu.analytic_story = ["Data Exfiltration", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$
 action.risk.param._risk = [{"threat_object_field": "uri_path", "threat_object_type": "url"}, {"threat_object_field": "form_data", "threat_object_type": "other"}]
@@ -36507,7 +36833,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Multiple Archive Files Http Post Traffic - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Command \u0026 Control", "Data Exfiltration"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "URL"}, {"name": "form_data", "role": ["Attacker"], "type": "Other"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration", "Command and Control"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "URL"}, {"name": "form_data", "role": ["Attacker"], "type": "Other"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
@@ -36542,7 +36868,7 @@ action.escu.full_search_name = ESCU - Plain HTTP POST Exfiltrated Data - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command \u0026 Control", "Data Exfiltration"]
+action.escu.analytic_story = ["Data Exfiltration", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$
 action.risk.param._risk = [{"threat_object_field": "uri_path", "threat_object_type": "url"}, {"threat_object_field": "form_data", "threat_object_type": "other"}]
@@ -36553,7 +36879,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Plain HTTP POST Exfiltrated Data - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Command \u0026 Control", "Data Exfiltration"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "URL"}, {"name": "form_data", "role": ["Attacker"], "type": "Other"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration", "Command and Control"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "URL"}, {"name": "form_data", "role": ["Attacker"], "type": "Other"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
@@ -36664,7 +36990,7 @@ action.escu.full_search_name = ESCU - Baseline of blocked outbound traffic from
 description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly.
 action.escu.creation_date = 2018-05-07
 action.escu.modification_date = 2018-05-07
-action.escu.analytic_story = ["AWS Network ACL Activity", "Command \u0026 Control", "Suspicious AWS Traffic"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"]
 action.escu.data_models = []
 cron_schedule = 0 * * * *
 enableSched = 1
@@ -36798,7 +37124,7 @@ action.escu.full_search_name = ESCU - Baseline of DNS Query Length - MLTK
 description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query.
 action.escu.creation_date = 2019-05-08
 action.escu.modification_date = 2019-05-08
-action.escu.analytic_story = ["Command \u0026 Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"]
+action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
 action.escu.data_models = ["Network_Resolution"]
 cron_schedule = 0 * * * *
 enableSched = 1
@@ -36930,7 +37256,7 @@ action.escu.full_search_name = ESCU - Count of Unique IPs Connecting to Ports
 description = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them.
 action.escu.creation_date = 2017-09-13
 action.escu.modification_date = 2017-09-13
-action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command \u0026 Control"]
+action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"]
 action.escu.data_models = ["Network_Traffic"]
 cron_schedule = 0 * * * *
 enableSched = 1
@@ -38122,7 +38448,7 @@ action.escu.full_search_name = ESCU - AWS Investigate User Activities By ARN - R
 description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
 action.escu.creation_date = 2019-04-30
 action.escu.modification_date = 2019-04-30
-action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "Cloud Cryptomining", "Command \u0026 Control", "Suspicious AWS EC2 Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Unusual AWS EC2 Modifications", "Suspicious Cloud User Activities", "AWS Suspicious Provisioning Activities", "Suspicious Cloud Instance Activities", "AWS Security Hub Alerts"]
+action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "Cloud Cryptomining", "Suspicious AWS EC2 Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Unusual AWS EC2 Modifications", "Suspicious Cloud User Activities", "AWS Suspicious Provisioning Activities", "Suspicious Cloud Instance Activities", "AWS Security Hub Alerts", "Command and Control"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -38143,7 +38469,7 @@ action.escu.full_search_name = ESCU - AWS Network ACL Details from ID - Response
 description = This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID
 action.escu.creation_date = 2017-01-22
 action.escu.modification_date = 2017-01-22
-action.escu.analytic_story = ["AWS Network ACL Activity", "Command \u0026 Control", "Suspicious AWS Traffic"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -38164,7 +38490,7 @@ action.escu.full_search_name = ESCU - AWS Network Interface details via resource
 description = This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, the public and the private IP associated with the network interface.
 action.escu.creation_date = 2018-05-07
 action.escu.modification_date = 2018-05-07
-action.escu.analytic_story = ["AWS Network ACL Activity", "Command \u0026 Control", "Suspicious AWS Traffic"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -38269,7 +38595,7 @@ action.escu.full_search_name = ESCU - Get All AWS Activity From IP Address - Res
 description = This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
 action.escu.creation_date = 2018-03-19
 action.escu.modification_date = 2018-03-19
-action.escu.analytic_story = ["AWS Network ACL Activity", "AWS Suspicious Provisioning Activities", "Command \u0026 Control", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Suspicious Cloud Instance Activities"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "AWS Suspicious Provisioning Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Suspicious Cloud Instance Activities", "Command and Control"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -38353,7 +38679,7 @@ action.escu.full_search_name = ESCU - Get DNS Server History for a host - Respon
 description = While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours.
 action.escu.creation_date = 2017-11-09
 action.escu.modification_date = 2017-11-09
-action.escu.analytic_story = ["AWS Network ACL Activity", "Command \u0026 Control", "DNS Hijacking", "Data Protection", "Dynamic DNS", "Hidden Cobra Malware", "Host Redirection", "Prohibited Traffic Allowed or Protocol Mismatch", "Suspicious AWS Traffic", "Suspicious DNS Traffic"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "DNS Hijacking", "Data Protection", "Dynamic DNS", "Hidden Cobra Malware", "Host Redirection", "Prohibited Traffic Allowed or Protocol Mismatch", "Suspicious AWS Traffic", "Suspicious DNS Traffic", "Command and Control"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -38374,7 +38700,7 @@ action.escu.full_search_name = ESCU - Get DNS traffic ratio - Response Task
 description = This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS.  
 action.escu.creation_date = 2017-11-09
 action.escu.modification_date = 2017-11-09
-action.escu.analytic_story = ["AWS Network ACL Activity", "Command \u0026 Control", "Data Protection", "Dynamic DNS", "Hidden Cobra Malware", "Suspicious AWS Traffic", "Suspicious DNS Traffic"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "Data Protection", "Dynamic DNS", "Hidden Cobra Malware", "Suspicious AWS Traffic", "Suspicious DNS Traffic", "Command and Control"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -38563,7 +38889,7 @@ action.escu.full_search_name = ESCU - Get Notable History - Response Task
 description = This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation.
 action.escu.creation_date = 2017-09-20
 action.escu.modification_date = 2017-09-20
-action.escu.analytic_story = ["AWS Cross Account Activity", "AWS Cryptomining", "AWS Network ACL Activity", "AWS User Monitoring", "Account Monitoring and Controls", "Apache Struts Vulnerability", "Asset Tracking", "Brand Monitoring", "Cloud Cryptomining", "ColdRoot MacOS RAT", "Collection and Staging", "Command \u0026 Control", "DHS Report TA18-074A", "DNS Amplification Attacks", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Host Redirection", "JBoss Vulnerability", "Kubernetes Scanning Activity", "Lateral Movement", "Malicious PowerShell", "Monitor Backup Solution", "Monitor for Unauthorized Software", "Monitor for Updates", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router and Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Splunk Enterprise Vulnerability", "Splunk Enterprise Vulnerability CVE-2018-11409", "Suspicious AWS EC2 Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Suspicious Cloud Authentication Activities", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual AWS EC2 Modifications", "Unusual Processes", "Use of Cleartext Protocols", "Web Fraud Detection", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "Data Exfiltration", "F5 TMUI RCE CVE-2020-5902", "Detect Zerologon Attack", "GCP Cross Account Activity", "Kubernetes Sensitive Object Access Activity", "Kubernetes Sensitive Role Activity", "Ransomware Cloud", "Ryuk Ransomware", "Suspicious Cloud Provisioning Activities", "Suspicious GCP Storage Activities", "Windows DNS SIGRed CVE-2020-1350"]
+action.escu.analytic_story = ["AWS Cross Account Activity", "AWS Cryptomining", "AWS Network ACL Activity", "AWS User Monitoring", "Account Monitoring and Controls", "Apache Struts Vulnerability", "Asset Tracking", "Brand Monitoring", "Cloud Cryptomining", "ColdRoot MacOS RAT", "Collection and Staging", "DHS Report TA18-074A", "DNS Amplification Attacks", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Host Redirection", "JBoss Vulnerability", "Kubernetes Scanning Activity", "Lateral Movement", "Malicious PowerShell", "Monitor Backup Solution", "Monitor for Unauthorized Software", "Monitor for Updates", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router and Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Splunk Enterprise Vulnerability", "Splunk Enterprise Vulnerability CVE-2018-11409", "Suspicious AWS EC2 Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Suspicious Cloud Authentication Activities", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual AWS EC2 Modifications", "Unusual Processes", "Use of Cleartext Protocols", "Web Fraud Detection", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "Data Exfiltration", "F5 TMUI RCE CVE-2020-5902", "Detect Zerologon Attack", "GCP Cross Account Activity", "Kubernetes Sensitive Object Access Activity", "Kubernetes Sensitive Role Activity", "Ransomware Cloud", "Ryuk Ransomware", "Suspicious Cloud Provisioning Activities", "Suspicious GCP Storage Activities", "Windows DNS SIGRed CVE-2020-1350", "Command and Control"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -38605,7 +38931,7 @@ action.escu.full_search_name = ESCU - Get Parent Process Info - Response Task
 description = This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest
 action.escu.creation_date = 2019-02-28
 action.escu.modification_date = 2019-02-28
-action.escu.analytic_story = ["Collection and Staging", "Command \u0026 Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse"]
+action.escu.analytic_story = ["Collection and Staging", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "Command and Control"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -38647,7 +38973,7 @@ action.escu.full_search_name = ESCU - Get Process Info - Response Task
 description = This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address.
 action.escu.creation_date = 2019-04-01
 action.escu.modification_date = 2019-04-01
-action.escu.analytic_story = ["AWS Network ACL Activity", "Collection and Staging", "Command \u0026 Control", "DHS Report TA18-074A", "Data Protection", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious AWS Traffic", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "Collection and Staging", "DHS Report TA18-074A", "Data Protection", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious AWS Traffic", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "Command and Control"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -38668,7 +38994,7 @@ action.escu.full_search_name = ESCU - Get Process Information For Port Activity
 description = This search will return information about the process associated with observed network traffic to a specific destination port from a specific host.
 action.escu.creation_date = 2019-04-01
 action.escu.modification_date = 2019-04-01
-action.escu.analytic_story = ["AWS Network ACL Activity", "Command \u0026 Control", "DHS Report TA18-074A", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious AWS Traffic", "Use of Cleartext Protocols"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "DHS Report TA18-074A", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious AWS Traffic", "Use of Cleartext Protocols", "Command and Control"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -38689,7 +39015,7 @@ action.escu.full_search_name = ESCU - Get Process Responsible For The DNS Traffi
 description = While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible for creating the DNS traffic.
 action.escu.creation_date = 2019-04-01
 action.escu.modification_date = 2019-04-01
-action.escu.analytic_story = ["AWS Network ACL Activity", "Brand Monitoring", "Command \u0026 Control", "Data Protection", "Dynamic DNS", "Hidden Cobra Malware", "Suspicious AWS Traffic", "Suspicious DNS Traffic"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "Brand Monitoring", "Data Protection", "Dynamic DNS", "Hidden Cobra Malware", "Suspicious AWS Traffic", "Suspicious DNS Traffic", "Command and Control"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-14T11:11:42 UTC
+# On Date: 2022-03-15T15:18:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -0,0 +1,12 @@
+name: Windows Disable Change Password Through Registry Unit Test
+tests:
+- name: Windows Disable Change Password Through Registry
+  file: endpoint/windows_disable_change_password_through_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog 
@@ -0,0 +1,12 @@
+name: Windows Disable Lock Workstation Feature Through Registry Unit Test
+tests:
+- name: Windows Disable Lock Workstation Feature Through Registry
+  file: endpoint/windows_disable_lock_workstation_feature_through_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog 
@@ -0,0 +1,12 @@
+name: Windows Disable LogOff Button Through Registry Unit Test
+tests:
+- name: Windows Disable LogOff Button Through Registry
+  file: endpoint/windows_disable_logoff_button_through_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog 
@@ -0,0 +1,12 @@
+name: Windows Disable Notification Center Unit Test
+tests:
+- name: Windows Disable Notification Center
+  file: endpoint/windows_disable_notification_center.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
@@ -0,0 +1,12 @@
+name: Windows Disable Shutdown Button Through Registry Unit Test
+tests:
+- name: Windows Disable Shutdown Button Through Registry
+  file: endpoint/windows_disable_shutdown_button_through_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog 
@@ -0,0 +1,12 @@
+name: Windows Disable Windows Group Policy Features Through Registry Unit Test
+tests:
+- name: Windows Disable Windows Group Policy Features Through Registry
+  file: endpoint/windows_disable_windows_group_policy_features_through_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog 
@@ -0,0 +1,12 @@
+name: Windows Hide Notification Features Through Registry Unit Test
+tests:
+- name: Windows Hide Notification Features Through Registry
+  file: endpoint/windows_hide_notification_features_through_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog