merged with develop

.gitignore

@@ -127,3 +127,4 @@ bin/docker_detection_tester/test_results/
 lookups/APP_ENRICHMENT_CACHE.db.db
 lookups/CVE_CACHE.db.db
 lookups/REFERENCE_CACHE.db.db	
+*.code-workspace

bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py

@@ -78,6 +78,7 @@ class ObjToYmlAdapter(Adapter):
                         "id": True,
                         "eventSchema": True,
                         "version": True,
+                        "status": True,
                         "description": True,
                         "search": True,
                         "how_to_implement": True,

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/detection/attacker_tools_on_endpoint.yml

@@ -1,13 +1,22 @@
 name: Attacker Tools On Endpoint
 id: a51bfe1a-94f0-48cc-b4e4-16a110145893
-version: 2
-date: '2021-11-04'
+version: 3
+date: '2023-08-25'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search looks for execution of commonly used attacker tools on an
-  endpoint.
+description: This search looks for the execution of commonly used attacker tools on an
+  endpoint. These tools, listed in the attacker_tools.csv, include remcom.exe, an open-source
+  replacement for psexec, pwdump.exe and pwdump2.exe, which are used to dump password hashes
+  on a Windows system, and nc.exe, an open-source tool used for network communications. Other
+  tools like wce.exe, used for dumping hashes and executing pass-the-hash and pass-the-ticket
+  attacks, and cain.exe, used for collecting user credentials and executing attacks, are also
+  monitored. The search also tracks tools like nmap.exe, an open-source network mapping tool,
+  and kidlogger.exe, used for collecting keyboard input on a host. The list also includes
+  tools that are used by attackers to hide in plain sight and look like legitimate Windows
+  system processes, such as isass.exe and svch0st.exe. The search is designed to provide
+  comprehensive monitoring of potential threats and unauthorized software on an endpoint.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(Processes.process) as process values(Processes.parent_process)
   as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown

detections/application/okta_mfa_exhaustion_hunt.yml

@@ -39,11 +39,11 @@ tags:
   asset_type: Infrastructure
   confidence: 60
   impact: 30
-  message: $src_user$ account has rejected multiple Okta pushes.
+  message: $user$ account has rejected multiple Okta pushes.
   mitre_attack_id:
   - T1110
   observable:
-  - name: src_user
+  - name: user
     type: User
     role:
     - Attacker
@@ -53,7 +53,7 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - src_user
+  - user
   - src_ip
   - eventType
   - status

detections/application/okta_two_or_more_rejected_okta_pushes.yml

@@ -33,11 +33,11 @@ tags:
   asset_type: Infrastructure
   confidence: 80
   impact: 80
-  message: $src_user$ account has rejected multiple Okta pushes.
+  message: $user$ account has rejected multiple Okta pushes.
   mitre_attack_id:
   - T1110
   observable:
-  - name: src_user
+  - name: user
     type: User
     role:
     - Attacker
@@ -47,7 +47,7 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - src_user
+  - user
   - src_ip
   - eventType
   - status

detections/application/splunk_dos_via_printf_search_function.yml

@@ -0,0 +1,50 @@
+name: Splunk DOS via printf search function
+id: 78b48d08-075c-4eac-bd07-e364c3780867
+version: 1
+date: '2023-08-30'
+author: Rod Soto, Eric McGinnis, Splunk
+status: production
+type: Hunting
+data_source: []
+description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.1.14, 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance.
+search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" search!="*audit_searches*" 
+  | stats count by user splunk_server host search 
+  | convert ctime(*time) |`splunk_dos_via_printf_search_function_filter`'
+how_to_implement: This search requires the ability to search internal indexes. 
+known_false_positives: This search may produces false positives, analyst most focuse in the use of printf conversion function of eval to craft an expression that splunkd cannot interpret correctly causing it to crash. 
+references:
+- https://advisory.splunk.com/
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: endpoint
+  confidence: 100
+  impact: 100
+  message: Possible denial of service attack against $host$
+  cve:
+  - CVE-2023-40594
+  mitre_attack_id:
+  - T1499.004
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 100
+  required_fields:
+  - user 
+  - splunk_server
+  - host
+  - search 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_printf_abuse.log
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit

detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml

@@ -30,7 +30,7 @@ tags:
   mitre_attack_id:
     - T1189
   observable:
-    - name: User
+    - name: user
       type: User
       role:
         - Victim

detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml

@@ -36,7 +36,7 @@ tags:
   mitre_attack_id:
   - T1588.004
   observable:
-  - name: Hostname
+  - name: host
     type: Hostname
     role:
     - Victim

detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml

@@ -38,7 +38,7 @@ tags:
   mitre_attack_id:
   - T1588.004
   observable:
-  - name: Hostname
+  - name: host
     type: Hostname
     role:
     - Victim

detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml

@@ -1,17 +1,13 @@
 name: Splunk risky Command Abuse disclosed february 2023
 id: ee69374a-d27e-4136-adac-956a96ff60fd
 version: 2
-date: '2023-02-14'
+date: '2023-08-30'
 author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
 status: production
 type: Hunting
-description: In February 2023, Splunk disclosed several vulnerabilities affecting
-  Splunk Enterprise commands deemed risky. The following hunting search includes the
-  following commands and versions. Command 'createrss' (versions 8.1.13, 8.2.10),
-  pivot (8.1.13,8.2.10,9.0.4), display.page.search.patterns.sensitivity(versions below
-  8.1.13,8.2.10,9.0.4), search_listener, map, collect (8.1.13,8.2.10,9.0.4). For more
-  information please review Splunk Vulnerabilities Disclosure, February 2023. Link
-  can be found in reference.
+description: This search looks for a variety of high-risk commands throughout
+  a number of different Splunk Vulnerability Disclosures.  Please refer to the
+  following URL for additional information on these disclosures - https://advisory.splunk.com
 data_source: []
 search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity
   where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user
@@ -35,6 +31,7 @@ tags:
   - CVE-2023-22936
   - CVE-2023-22939
   - CVE-2023-22940
+  - CVE-2023-40598
   impact: 50
   message: Use of risky splunk command $splunk_risky_command$ detected by $user$
   mitre_attack_id:
@@ -67,3 +64,9 @@ tests:
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
+- name: True Positive Test runshellscript abuse
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_runshellscript_abuse.log
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit

detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml

@@ -25,9 +25,8 @@ references:
 - https://twitter.com/jhencinski/status/1618660062352007174
 tags:
   analytic_story:
-  - Compromised User Account
-  - Azure Active Directory Account Takeover
-  asset_type: Azure Active Directory
+  - AWS Identity and Access Management Account Takeover
+  asset_type: AWS Account
   confidence: 80
   impact: 80
   message: A new virtual device is added to user $identity.user.name$

detections/cloud/aws_exfiltration_via_batch_service.yml

@@ -2,12 +2,12 @@ name: AWS Exfiltration via Batch Service
 id: 04455dd3-ced7-480f-b8e6-5469b99e98e2
 version: 1
 date: '2023-04-24'
-author: ''
+author: Bhavin Patel, Splunk
 status: production
 type: TTP
 data_source: []
 description: This search looks for events where AWS Batch Service is used for creating a job that could potentially abuse the AWS Bucket Replication feature on S3 buckets. This AWS service can used to transfer data between different AWS S3 buckets and an attacker can leverage this to exfiltrate data by creating a malicious batch job. 
-search: '`cloudtrail` eventName = JobCreated |  stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`'
+search: '`cloudtrail` eventName = JobCreated |  stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip  aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
 known_false_positives: It is possible that an AWS Administrator or a user has legitimately created this job for some tasks. 
@@ -20,14 +20,10 @@ tags:
   asset_type: AWS Account
   confidence: 80
   impact: 80
-  message: AWS Batch Job is created on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$
+  message: AWS Batch Job is created on account id - $aws_account_id$ from src_ip $src_ip$
   mitre_attack_id:
   - T1119
   observable:
-  - name: user_arn
-    type: User
-    role:
-    - Attacker
   - name: src_ip
     type: IP Address
     role:

detections/cloud/aws_exfiltration_via_ec2_snapshot.yml

@@ -23,11 +23,11 @@ tags:
   asset_type: EC2 Snapshot
   confidence: 80
   impact: 80
-  message: Potential AWS EC2 Exfiltration detected on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$
+  message: Potential AWS EC2 Exfiltration detected on account id - $aws_account_id$ by user $userName$ from src_ip $src_ip$
   mitre_attack_id:
   - T1537
   observable:
-  - name: user_arn
+  - name: userName
     type: User
     role:
     - Attacker

detections/cloud/aws_high_number_of_failed_authentications_for_user.yml

@@ -32,11 +32,7 @@ tags:
   mitre_attack_id:
   - T1201
   observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  - name: user_arn
+  - name: user_name
     type: User
     role:
     - Attacker

detections/cloud/aws_iam_delete_policy.yml

@@ -13,8 +13,8 @@ description: The following detection identifes when a policy is deleted on AWS.
 data_source: []
 search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats
   count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
-  as policyArn by src eventName eventSource aws_account_id errorCode errorMessage
-  userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)`
+  as policyArn by src user_arn eventName eventSource aws_account_id errorCode errorMessage
+  userAgent eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`'
 how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
   this data. The search requires AWS Cloudtrail logs.

detections/cloud/aws_network_access_control_list_deleted.yml

@@ -12,7 +12,7 @@ description: Enforcing network-access controls is one of the defensive mechanism
   will query the AWS CloudTrail logs to detect users deleting network ACLs.
 data_source: []
 search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
-  | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName
+  | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by user_arn
   userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)

detections/cloud/aws_new_mfa_method_registered_for_user.yml

@@ -25,17 +25,16 @@ references:
 - https://twitter.com/jhencinski/status/1618660062352007174
 tags:
   analytic_story:
-  - Compromised User Account
-  - Azure Active Directory Account Takeover
-  asset_type: Azure Active Directory
+  - AWS Identity and Access Management Account Takeover
+  asset_type: AWS Account
   confidence: 80
   impact: 80
-  message: A new virtual device $virtualMFADeviceName$ is added to user  $user_arn$
+  message: A new virtual device $virtualMFADeviceName$ is added to user $user_arn$
   mitre_attack_id:
   - T1556
   - T1556.006
   observable:
-  - name: user_name
+  - name: user_arn
     type: User
     role:
     - Victim

detections/cloud/azure_active_directory_high_risk_sign_in.yml

@@ -2,7 +2,7 @@ name: Azure Active Directory High Risk Sign-in
 id: 1ecff169-26d7-4161-9a7b-2ac4c8e61bea
 version: 1
 date: '2022-07-11'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic triggers on a high risk sign-in against Azure
@@ -10,13 +10,12 @@ description: The following analytic triggers on a high risk sign-in against Azur
   sign-in events using heuristics and machine learning to identify potentially malicious
   events and categorizes them in three categories high, medium and low.
 data_source: []
-search: ' `azuread` body.category=UserRiskEvents body.properties.riskLevel=high |
-  rename body.properties.* as * |  stats values(userPrincipalName) by _time, ipAddress,
+search: ' `azuread` category=UserRiskEvents properties.riskLevel=high |
+  rename properties.* as * |  stats values(userPrincipalName) as userPrincipalName by _time, ipAddress,
   activity, riskLevel, riskEventType, additionalInfo | `azure_active_directory_high_risk_sign_in_filter`'
-how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft
-  Cloud Services from  Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
-  You must be ingesting Azure Active Directory events in your Splunk environment.
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category.
 known_false_positives: Details for the risk calculation algorithm used by Identity
   Protection are unknown and may be prone to false positives.
@@ -31,7 +30,7 @@ tags:
   asset_type: Azure Active Directory
   confidence: 90
   impact: 60
-  message: A high risk event was identified by Identify Protection for user $body.properties.userPrincipalName$
+  message: A high risk event was identified by Identify Protection for user $userPrincipalName$
   mitre_attack_id:
   - T1586
   - T1586.003
@@ -52,13 +51,13 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.category
-  - body.properties.riskLevel
-  - body.properties.userPrincipalName
-  - body.properties.ipAddress
-  - body.properties.activity
-  - body.properties.riskEventType
-  - body.properties.additionalInfo
+  - category
+  - properties.riskLevel
+  - properties.userPrincipalName
+  - properties.ipAddress
+  - properties.activity
+  - properties.riskEventType
+  - properties.additionalInfo
   risk_score: 54
   security_domain: identity
 tests:

detections/cloud/azure_ad_application_administrator_role_assigned.yml

@@ -2,7 +2,7 @@ name: Azure AD Application Administrator Role Assigned
 id: eac4de87-7a56-4538-a21b-277897af6d8d
 version: 1
 date: '2023-04-25'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 data_source: []
@@ -12,11 +12,11 @@ description: The following analytic identifies the assignment of the Application
   been granted access to a resource, such as the ability to create or update User or other objects, then a user assigned to this role could perform those actions while
   impersonating the application. This ability to impersonate the applications identity may be an elevation of privilege over what the user can do via their role assignments.
   Red teams and adversaries alike may abuse this role to escalate their privileges in an Azure AD tenant.
-search: ' `azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Application Administrator\"" 
-  | rename body.properties.* as * 
+search: ' `azuread` "operationName"="Add member to role"  "properties.targetResources{}.modifiedProperties{}.newValue"="\"Application Administrator\"" 
+  | rename properties.* as * 
   | rename targetResources{}.userPrincipalName as userPrincipalName 
   | rename initiatedBy.user.userPrincipalName as initiatedBy
-  | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName
+  | stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName
   | `azure_ad_application_administrator_role_assigned_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
@@ -57,10 +57,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.properties.targetResources{}.userPrincipalName
-  - body.properties.targetResources{}.type
-  - body.properties.initiatedBy.user.userPrincipalName
-  - body.properties.result
+  - properties.targetResources{}.userPrincipalName
+  - properties.targetResources{}.type
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.result
   risk_score: 35
   security_domain: endpoint
 tests:

detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml

@@ -2,7 +2,7 @@ name: Azure AD Authentication Failed During MFA Challenge
 id: e62c9c2e-bf51-4719-906c-3074618fcc1c
 version: 1
 date: '2022-07-14'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: 'The following analytic identifies an authentication attempt event against
@@ -11,12 +11,12 @@ description: 'The following analytic identifies an authentication attempt event
   This behavior may represent an adversary trying to authenticate with compromised
   credentials for an account that has multi-factor authentication enabled. '
 data_source: []
-search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121
-  | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress,
+search: ' `azuread` category=SignInLogs properties.status.errorCode=500121
+  | rename properties.* as * | stats values(userPrincipalName) as userPrincipalName by _time, ipAddress,
   status.additionalDetails, appDisplayName, userAgent | `azure_ad_authentication_failed_during_mfa_challenge_filter`'
-how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft
-  Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events in your Splunk environment.
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the SignInLogs log category.
 known_false_positives: Legitimate users may miss to reply the MFA challenge within
   the time window or deny it by mistake.
@@ -30,7 +30,7 @@ tags:
   asset_type: Azure Active Directory
   confidence: 90
   impact: 60
-  message: User $body.properties.userPrincipalName$ failed to pass MFA challenge
+  message: User $userPrincipalName$ failed to pass MFA challenge
   mitre_attack_id:
   - T1586
   - T1586.003
@@ -52,13 +52,13 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.category
-  - body.properties.status.errorCode
-  - body.properties.userPrincipalName
-  - body.properties.ipAddress
-  - body.properties.status.additionalDetails
-  - body.properties.appDisplayName
-  - body.properties.userAgent
+  - category
+  - properties.status.errorCode
+  - properties.userPrincipalName
+  - properties.ipAddress
+  - properties.status.additionalDetails
+  - properties.appDisplayName
+  - properties.userAgent
   risk_score: 54
   security_domain: identity
 tests:

detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml

@@ -14,11 +14,11 @@ description: The following analytic identifies an Azure AD account with concurre
 data_source: []
 search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs
   | rename properties.* as * | bucket span=5m _time | stats  dc(ipAddress) AS unique_ips
-  values(ipAddress) values(appDisplayName) by _time, userPrincipalName | where unique_ips
+  values(ipAddress) as ipAddress values(appDisplayName) by _time, userPrincipalName | where unique_ips
   > 1 | `azure_ad_concurrent_sessions_from_different_ips_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the SignInLogs log category.
 known_false_positives: A user with concurrent sessions from different Ips may also
   represent the legitimate use of more than one device. Filter as needed and/or customize

detections/cloud/azure_ad_external_guest_user_invited.yml

@@ -13,10 +13,10 @@ description: The following analytic identifies the invitation of an external gue
   2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking
   Azure AD Accounts by Abusing External Identities`
 data_source: []
-search: '`azuread` "body.operationName"="Invite external user" | rename body.properties.*
+search: '`azuread` "operationName"="Invite external user" | rename properties.*
   as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename
   initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.type
-  as type | stats values(userPrincipalName) by _time, type, initiatedBy, result, body.operationName
+  as type | stats values(userPrincipalName) as userPrincipalName by _time, type, initiatedBy, result, operationName
   | `azure_ad_external_guest_user_invited_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
@@ -53,10 +53,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.properties.targetResources{}.userPrincipalName
-  - body.properties.targetResources{}.type
-  - body.properties.initiatedBy.user.userPrincipalName
-  - body.properties.result
+  - properties.targetResources{}.userPrincipalName
+  - properties.targetResources{}.type
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.result
   risk_score: 45
   security_domain: threat
 tests:

detections/cloud/azure_ad_global_administrator_role_assigned.yml

@@ -1,6 +1,6 @@
 name: Azure AD Global Administrator Role Assigned
 id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c
-version: 2
+version: 3
 date: '2022-08-17'
 author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
 status: production
@@ -14,14 +14,15 @@ description: The following analytic identifies the assignment of the Azure AD Gl
   to gain control of Azure resources. Adversaries and red teams alike may assign this
   role to a compromised account to establish Persistence or escalate their privileges in an Azure AD environment.
 data_source: []
-search: '`azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global
-  Administrator\"" | rename body.properties.* as * | rename targetResources{}.userPrincipalName
-  as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy
-  | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName
+search: '`azuread` operationName="Add member to role"  properties.targetResources{}.modifiedProperties{}.newValue="\"Global Administrator\""
+  | rename properties.* as *
+  | rename targetResources{}.userPrincipalName as userPrincipalName
+  | rename initiatedBy.user.userPrincipalName as initiatedBy
+  | stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName
   | `azure_ad_global_administrator_role_assigned_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the AuditLogs log category.
 known_false_positives: Administrators may legitimately assign the Global Administrator
   role to a user. Filter as needed.
@@ -58,10 +59,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.properties.targetResources{}.userPrincipalName
-  - body.properties.targetResources{}.type
-  - body.properties.initiatedBy.user.userPrincipalName
-  - body.properties.result
+  - properties.targetResources{}.userPrincipalName
+  - properties.targetResources{}.type
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.result
   risk_score: 72
   security_domain: threat
 tests:

detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml

@@ -15,7 +15,7 @@ search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 prope
   by userPrincipalName, _time | where failed_attempts > 20 | `azure_ad_high_number_of_failed_authentications_for_user_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the SignInLogs log category.
 known_false_positives: A user with more than 20 failed authentication attempts in
   the span of 5 minutes may also be triggered by a broken application.

detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml

@@ -13,10 +13,10 @@ description: The following analytic identifies an Ip address failing to authenti
 data_source: []
 search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
   | rename properties.* as * | bucket span=5m _time | stats  dc(_raw) AS failed_attempts
-  values(userPrincipalName) by ipAddress, _time | where failed_attempts > 20 | `azure_ad_high_number_of_failed_authentications_from_ip_filter`'
+  values(userPrincipalName) as userPrincipalName by ipAddress, _time | where failed_attempts > 20 | `azure_ad_high_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the SignInLogs log category.
 known_false_positives: An Ip address with more than 20 failed authentication attempts
   in the span of 5 minutes may also be triggered by a broken application.

detections/cloud/azure_ad_multi_factor_authentication_disabled.yml

@@ -2,7 +2,7 @@ name: Azure AD Multi-Factor Authentication Disabled
 id: 482dd42a-acfa-486b-a0bb-d6fcda27318e
 version: 1
 date: '2022-08-10'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic identifies an attempt to disable multi-factor
@@ -11,14 +11,14 @@ description: The following analytic identifies an attempt to disable multi-facto
   and maintain persistence using a valid account. This way the attackers can keep
   persistance in the environment without adding new users.
 data_source: []
-search: '`azuread` body.category=AuditLogs body.operationName="Disable Strong Authentication"
-  | rename body.properties.* as * | rename targetResources{}.userPrincipalName as
+search: '`azuread` category=AuditLogs operationName="Disable Strong Authentication"
+  | rename properties.* as * | rename targetResources{}.userPrincipalName as
   userPrincipalName | rename targetResources{}.type as type | rename initiatedBy.user.userPrincipalName
-  as initiatedBy | stats values(userPrincipalName) by _time, type, body.operationName,
+  as initiatedBy | stats values(userPrincipalName) as userPrincipalName by _time, type, operationName,
   initiatedBy, result | `azure_ad_multi_factor_authentication_disabled_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
-  Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the AuditLogs log category.
 known_false_positives: Legitimate use case may require for users to disable MFA. Filter
   as needed.
@@ -54,10 +54,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.properties.targetResources{}.userPrincipalName
-  - body.properties.targetResources{}.type
-  - body.properties.initiatedBy.user.userPrincipalName
-  - body.properties.result
+  - properties.targetResources{}.userPrincipalName
+  - properties.targetResources{}.type
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.result
   risk_score: 45
   security_domain: identity
 tests:

detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml

@@ -2,7 +2,7 @@ name: Azure AD Multiple Failed MFA Requests For User
 id: 264ea131-ab1f-41b8-90e0-33ad1a1888ea
 version: 1
 date: '2022-08-25'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic identifies multiple failed multi-factor authentication
@@ -18,13 +18,13 @@ description: The following analytic identifies multiple failed multi-factor auth
   this technique to bypass multi-factor authentication controls as reported by Mandiant
   and others.
 data_source: []
-search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121
-  | rename body.properties.* as * | bucket span=10m _time | stats dc(_raw) AS mfa_prompts
-  values(userPrincipalName) by userPrincipalName, status.additionalDetails, appDisplayName,
+search: ' `azuread` category=SignInLogs properties.status.errorCode=500121
+  | rename properties.* as * | bucket span=10m _time | stats dc(_raw) AS mfa_prompts
+  values(ipAddress) as ipAddress by userPrincipalName, status.additionalDetails, appDisplayName,
   userAgent, _time | where mfa_prompts > 10 | `azure_ad_multiple_failed_mfa_requests_for_user_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the SignInLogs log category.
 known_false_positives: Multiple Failed MFA requests may also be a sign of authentication
   or application issues. Filter as needed.
@@ -40,7 +40,7 @@ tags:
   asset_type: Azure Active Directory
   confidence: 90
   impact: 60
-  message: Multiple Failed MFA requests for user $body.properties.userPrincipalName$
+  message: Multiple Failed MFA requests for user $userPrincipalName$
   mitre_attack_id:
   - T1586
   - T1586.003
@@ -52,21 +52,17 @@ tags:
     type: User
     role:
     - Victim
-  - name: ipAddress
-    type: IP Address
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - _time
-  - body.properties.status.errorCode
-  - body.category
-  - body.properties.authenticationDetails
-  - body.properties.userPrincipalName
-  - body.properties.ipAddress
+  - properties.status.errorCode
+  - category
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
   risk_score: 54
   security_domain: identity
 tests:

detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml

@@ -2,7 +2,7 @@ name: Azure AD Multiple Users Failing To Authenticate From Ip
 id: 94481a6a-8f59-4c86-957f-55a71e3612a6
 version: 1
 date: '2022-07-12'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: Anomaly
 description: 'The following analytic identifies one source Ip failing to authenticate
@@ -15,13 +15,15 @@ description: 'The following analytic identifies one source Ip failing to authent
   Azure AD tenants can be very different depending on the organization. Users should
   test this detection and customize the arbitrary threshold if needed.'
 data_source: []
-search: ' `azuread` body.category= SignInLogs body.properties.status.errorCode=50126
-  body.properties.authenticationDetails{}.succeeded= false | rename body.properties.*
-  as * | bucket span=5m _time | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName)
-  as tried_accounts by _time, ipAddress | where unique_accounts > 30 | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`'
+search: ' `azuread` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
+| rename properties.* as *
+| bucket span=5m _time
+| stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as userPrincipalName by _time, ipAddress
+| where unique_accounts > 30 
+| `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the SignInLogs log category.
 known_false_positives: A source Ip failing to authenticate with multiple users is
   not a common for legitimate behavior.
@@ -36,7 +38,7 @@ tags:
   asset_type: Azure Active Directory
   confidence: 90
   impact: 70
-  message: Source Ip $body.properties.ipAddress$ failed to authenticate with 30 users
+  message: Source Ip $ipAddress$ failed to authenticate with 30 users
     within 5 minutes.
   mitre_attack_id:
   - T1586
@@ -59,17 +61,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.properties.status.errorCode
-  - body.category
-  - body.properties.authenticationDetails
-  - body.properties.userPrincipalName
-  - body.properties.ipAddress
+  - properties.status.errorCode
+  - category
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
   risk_score: 63
   security_domain: identity
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/password_spraying_azuread/azuread_signin.log
     source: mscs:azure:eventhub
     sourcetype: mscs:azure:eventhub
     update_timestamp: true

detections/cloud/azure_ad_new_custom_domain_added.yml

@@ -2,7 +2,7 @@ name: Azure AD New Custom Domain Added
 id: 30c47f45-dd6a-4720-9963-0bca6c8686ef
 version: 1
 date: '2022-09-02'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic identifies the addition of a new custom domain
@@ -19,10 +19,10 @@ description: The following analytic identifies the addition of a new custom doma
   persistence and be able to authenticate to Azure AD impersonating any user and bypassing
   the requirement to have a valid password and/or perform MFA.
 data_source: []
-search: ' `azuread` body.operationName="Add unverified domain" "body.properties.result"=success
-  | rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress
+search: ' `azuread` operationName="Add unverified domain" "properties.result"=success
+  | rename properties.* as * | rename callerIpAddress as callerIpAddress
   | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.displayName
-  as domain | stats values(domain) by _time, initiatedBy, result, body.operationName,
+  as domain | stats values(domain) by _time, initiatedBy, result, operationName,
   callerIpAddress | `azure_ad_new_custom_domain_added_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
@@ -58,11 +58,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.operationName
-  - body.properties.result
-  - body.callerIpAddress
-  - body.properties.targetResources{}.displayName
-  - body.properties.initiatedBy.user.userPrincipalName
+  - operationName
+  - properties.result
+  - callerIpAddress
+  - properties.targetResources{}.displayName
+  - properties.initiatedBy.user.userPrincipalName
   risk_score: 54
   security_domain: threat
 tests:

detections/cloud/azure_ad_new_federated_domain_added.yml

@@ -2,7 +2,7 @@ name: Azure AD New Federated Domain Added
 id: a87cd633-076d-4ab2-9047-977751a3c1a0
 version: 1
 date: '2022-09-02'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic identifies the addition of a new federated domain
@@ -19,10 +19,10 @@ description: The following analytic identifies the addition of a new federated d
   persistence and be able to authenticate to Azure AD impersonating any user and bypassing
   the requirement to have a valid password and/or perform MFA.
 data_source: []
-search: ' `azuread` body.operationName="Set domain authentication" "body.properties.result"=success
-  | rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress
+search: ' `azuread` operationName="Set domain authentication" "properties.result"=success
+  | rename properties.* as * | rename callerIpAddress as callerIpAddress
   | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.displayName
-  as domain | stats values(domain) by _time, initiatedBy, result, body.operationName,
+  as domain | stats values(domain) by _time, initiatedBy, result, operationName,
   callerIpAddress | `azure_ad_new_federated_domain_added_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
@@ -57,11 +57,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.operationName
-  - body.properties.result
-  - body.callerIpAddress
-  - body.properties.targetResources{}.displayName
-  - body.properties.initiatedBy.user.userPrincipalName
+  - operationName
+  - properties.result
+  - callerIpAddress
+  - properties.targetResources{}.displayName
+  - properties.initiatedBy.user.userPrincipalName
   risk_score: 81
   security_domain: threat
 tests:

detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml

@@ -11,11 +11,11 @@ description: The following analytic identifies the registration of a new Multi F
 data_source: []
 search: ' `azuread` category=AuditLogs operationName="User registered security info"
   properties.operationType=Add | rename properties.* as * | rename targetResources{}.*
-  as * | stats  values(userPrincipalName) by _time, resultDescription, result, callerIpAddress
+  as * | stats  values(userPrincipalName) as userPrincipalName by _time, resultDescription, result, callerIpAddress
   | `azure_ad_new_mfa_method_registered_for_user_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the AuditLogs log category.
 known_false_positives: Newly onboarded users who are registering an MFA method for
   the first time will also trigger this detection.

detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml

@@ -2,7 +2,7 @@ name: Azure AD Privileged Authentication Administrator Role Assigned
 id: a7da845d-6fae-41cf-b823-6c0b8c55814a
 version: 1
 date: '2023-04-25'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 data_source: []
@@ -10,11 +10,11 @@ description: The following analytic identifies the assignment of the Privileged
   methods for any user in Azure Active Directory, including privileged roles like Global Administrators. Users with this role can change credentials for people who may have access to sensitive
   or private information or critical configuration inside and outside of Azure Active Directory. Changing the credentials of a user may mean the ability to assume that users identity and permissions.
   Red teams and adversaries alike may abuse this role to escalate their privileges.
-search: ' `azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\"" 
-  | rename body.properties.* as * 
+search: ' `azuread` "operationName"="Add member to role"  "properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\"" 
+  | rename properties.* as * 
   | rename targetResources{}.userPrincipalName as userPrincipalName 
   | rename initiatedBy.user.userPrincipalName as initiatedBy
-  | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName
+  | stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName
   | `azure_ad_privileged_authentication_administrator_role_assigned_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
@@ -51,10 +51,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.properties.targetResources{}.userPrincipalName
-  - body.properties.targetResources{}.type
-  - body.properties.initiatedBy.user.userPrincipalName
-  - body.properties.result
+  - properties.targetResources{}.userPrincipalName
+  - properties.targetResources{}.type
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.result
   risk_score: 50
   security_domain: identity
 tests:

detections/cloud/azure_ad_privileged_role_assigned.yml

@@ -2,7 +2,7 @@ name: Azure AD Privileged Role Assigned
 id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a
 version: 1
 date: '2022-08-29'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic identifies the assignment of sensitive and privileged
@@ -10,14 +10,14 @@ description: The following analytic identifies the assignment of sensitive and p
   may assign these roles to a compromised account to establish Persistence in an Azure
   AD environment.
 data_source: []
-search: ' `azuread` "body.operationName"="Add member to role" | rename body.properties.*  as * 
+search: ' `azuread` "operationName"="Add member to role" | rename properties.*  as * 
   | rename targetResources{}.userPrincipalName as userPrincipalName 
   | rename initiatedBy.user.userPrincipalName as initiatedBy 
   | rename targetResources{}.modifiedProperties{}.newValue  as roles 
   | eval role=mvindex(roles,1) 
   | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description 
   | search isprvilegedadrole = True
-  | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName, role, description 
+  | stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName, role, description 
   | `azure_ad_privileged_role_assigned_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
@@ -58,10 +58,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.properties.targetResources{}.userPrincipalName
-  - body.properties.targetResources{}.type
-  - body.properties.initiatedBy.user.userPrincipalName
-  - body.properties.result
+  - properties.targetResources{}.userPrincipalName
+  - properties.targetResources{}.type
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.result
   risk_score: 63
   security_domain: audit
 tests:

detections/cloud/azure_ad_service_principal_created.yml

@@ -14,14 +14,16 @@ description: The following analytic identifies the creation of a Service Princip
   access may create a Service Principal to establish Persistence and obtain single-factor
   access to an Azure AD environment.
 data_source: []
-search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=*
-  | rename body.properties.* as * | rename targetResources{}.displayName as displayName
-  | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.type
-  as type | stats values(displayName) by _time, type, initiatedBy, result, body.operationName
+search: '`azuread` operationName="Add service principal" properties.initiatedBy.user.id=*
+  | rename properties.* as * 
+  | rename targetResources{}.displayName as displayName
+  | rename initiatedBy.user.userPrincipalName as initiatedBy
+  | rename targetResources{}.type as type
+  | stats values(displayName) as displayName by _time, type, initiatedBy, result, operationName
   | `azure_ad_service_principal_created_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
+  You must be ingesting Azure Active Directory events into your Splunk environment thorough an EventHub.
   Specifically, this analytic leverages the AuditLogs log category.
 known_false_positives: Administrator may legitimately create Service Principal. Filter
   as needed.
@@ -55,10 +57,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.properties.targetResources{}.displayName
-  - body.properties.targetResources{}.type
-  - body.properties.initiatedBy.user.userPrincipalName
-  - body.properties.result
+  - properties.targetResources{}.displayName
+  - properties.targetResources{}.type
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.result
   risk_score: 45
   security_domain: threat
 tests:

detections/cloud/azure_ad_service_principal_new_client_credentials.yml

@@ -2,7 +2,7 @@ name: Azure AD Service Principal New Client Credentials
 id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a
 version: 2
 date: '2022-08-17'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic identifies the addition of new credentials for Service
@@ -16,9 +16,9 @@ description: The following analytic identifies the addition of new credentials f
   with privileged access, attackers may also escalate their privileges in an Azure AD environment by adding new credentials and 
   logging in as the service principal.
 data_source: []
-search: ' `azuread` body.category=AuditLogs body.operationName="Update application*Certificates
-  and secrets management " | rename body.* as * | rename properties.* as * | rename
-  targetResources{}.* as * | stats values(displayName) by _time, initiatedBy.user.userPrincipalName,
+search: ' `azuread` category=AuditLogs operationName="Update application*Certificates
+  and secrets management " | rename * as * | rename properties.* as * | rename
+  targetResources{}.* as * | stats values(displayName) as displayName by _time, initiatedBy.user.userPrincipalName,
   modifiedProperties{}.newValue | `azure_ad_service_principal_new_client_credentials_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
@@ -40,7 +40,7 @@ tags:
   asset_type: Azure Active Directory
   confidence: 50
   impact: 70
-  message: New credentials added for Service Principal $body.properties.targetResources{}.displayName$
+  message: New credentials added for Service Principal $properties.targetResources{}.displayName$
   mitre_attack_id:
   - T1098
   - T1098.001
@@ -59,11 +59,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.category
-  - body.operationName
-  - body.properties.initiatedBy.user.userPrincipalName
-  - body.properties.targetResources{}.displayName
-  - body.properties.targetResources{}.modifiedProperties{}.newValue
+  - category
+  - operationName
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.targetResources{}.displayName
+  - properties.targetResources{}.modifiedProperties{}.newValue
   risk_score: 35
   security_domain: threat
 tests:

detections/cloud/azure_ad_service_principal_owner_added.yml

@@ -2,7 +2,7 @@ name: Azure AD Service Principal Owner Added
 id: 7ddf2084-6cf3-4a44-be83-474f7b73c701
 version: 2
 date: '2022-08-30'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic identifies the addition of a new owner for a Service
@@ -15,15 +15,18 @@ description: The following analytic identifies the addition of a new owner for a
   and obtain single-factor access to an Azure AD environment. Attackers who are looking to
   escalate their privileges by leveraging a Service Principals permissions may also add a new owner.
 data_source: []
-search: ' `azuread` body.operationName="Add owner to application" | rename body.properties.*
-  as * | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.userPrincipalName
-  as newOwner | rename targetResources{}.modifiedProperties{}.newValue as displayName
-  | eval displayName = mvindex(displayName,1) | where  initiatedBy!=newOwner | stats
-  values(displayName) by _time, initiatedBy, result, body.operationName, newOwner
+search: ' `azuread` operationName="Add owner to application"
+  | rename properties.* as *
+  | rename initiatedBy.user.userPrincipalName as initiatedBy
+  | rename targetResources{}.userPrincipalName as newOwner
+  | rename targetResources{}.modifiedProperties{}.newValue as displayName
+  | eval displayName = mvindex(displayName,1) 
+  | where initiatedBy!=newOwner
+  | stats values(displayName) as displayName by _time, initiatedBy, result, operationName, newOwner
   | `azure_ad_service_principal_owner_added_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the AuditLogs log category.
 known_false_positives: Administrator may legitimately add new owners for Service Principals.
   Filter as needed.
@@ -54,11 +57,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.operationName
-  - body.properties.initiatedBy.user.userPrincipalName
-  - body.properties.targetResources{}.userPrincipalName
-  - body.properties.targetResources{}.modifiedProperties{}.newValue
-  - body.propertiesresult
+  - operationName
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.targetResources{}.userPrincipalName
+  - properties.targetResources{}.modifiedProperties{}.newValue
+  - properties.result
   risk_score: 54
   security_domain: audit
 tests:

detections/cloud/azure_ad_successful_authentication_from_different_ips.yml

@@ -14,11 +14,11 @@ description: The following analytic identifies an Azure AD account successfully
 data_source: []
 search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=SignInLogs
   | rename properties.* as * | bucket span=5m _time | stats  dc(ipAddress) AS unique_ips
-  values(ipAddress) values(appDisplayName) by _time, userPrincipalName | where unique_ips
+  values(ipAddress) as ipAddress values(appDisplayName) by _time, userPrincipalName | where unique_ips
   > 1 | `azure_ad_successful_authentication_from_different_ips_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events into your Splunk environment.
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the SignInLogs log category.
 known_false_positives: A user with successful authentication events from different
   Ips may also represent the legitimate use of more than one device. Filter as needed

detections/cloud/azure_ad_successful_powershell_authentication.yml

@@ -2,7 +2,7 @@ name: Azure AD Successful PowerShell Authentication
 id: 62f10052-d7b3-4e48-b57b-56f8e3ac7ceb
 version: 1
 date: '2022-07-13'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic identifies a successful authentication event against
@@ -11,13 +11,13 @@ description: The following analytic identifies a successful authentication event
   and red teams  alike will perform enumeration and discovery techniques. One method
   of executing these techniques is leveraging the native PowerShell modules.
 data_source: []
-search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetails{}.succeeded=true
-  body.properties.appDisplayName="Azure Active Directory PowerShell" | rename body.properties.*
-  as * |  stats values(userPrincipalName) by _time, ipAddress, appDisplayName, userAgent
+search: ' `azuread` category=SignInLogs properties.authenticationDetails{}.succeeded=true
+  properties.appDisplayName="Microsoft Azure PowerShell" | rename properties.*
+  as * |  stats values(userPrincipalName) as userPrincipalName by _time, ipAddress, appDisplayName, userAgent
   | `azure_ad_successful_powershell_authentication_filter`'
-how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft
-  Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events in your Splunk environment.
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the SignInLogs log category.
 known_false_positives: Administrative users will likely use PowerShell commandlets
   to troubleshoot and maintain the environment. Filter as needed.
@@ -32,7 +32,7 @@ tags:
   asset_type: Azure Active Directory
   confidence: 90
   impact: 60
-  message: Successful authentication for user $body.properties.userPrincipalName$
+  message: Successful authentication for user $userPrincipalName$
     using PowerShell.
   mitre_attack_id:
   - T1586
@@ -54,12 +54,12 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.properties.appDisplayName
-  - body.category
-  - body.properties.userPrincipalName
-  - body.properties.ipAddress
-  - body.properties.appDisplayName
-  - body.properties.userAgent
+  - properties.appDisplayName
+  - category
+  - properties.userPrincipalName
+  - properties.ipAddress
+  - properties.appDisplayName
+  - properties.userAgent
   risk_score: 54
   security_domain: identity
 tests:

detections/cloud/azure_ad_successful_single_factor_authentication.yml

@@ -2,7 +2,7 @@ name: Azure AD Successful Single-Factor Authentication
 id: a560e7f6-1711-4353-885b-40be53101fcd
 version: 1
 date: '2022-07-12'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic identifies a successful authentication event against
@@ -10,13 +10,13 @@ description: The following analytic identifies a successful authentication event
   This could be evidence of a missconfiguration, a policy violation or an account
   take over attempt that should be investigated
 data_source: []
-search: ' `azuread`  body.category=SignInLogs body.properties.authenticationRequirement=singleFactorAuthentication
-  body.properties.authenticationDetails{}.succeeded=true | rename body.properties.*
-  as * |  stats values(userPrincipalName) by _time, ipAddress, appDisplayName, authenticationRequirement
+search: ' `azuread`  category=SignInLogs properties.authenticationRequirement=singleFactorAuthentication
+  properties.authenticationDetails{}.succeeded=true | rename properties.*
+  as * |  stats values(userPrincipalName) as userPrincipalName by _time, ipAddress, appDisplayName, authenticationRequirement
   | `azure_ad_successful_single_factor_authentication_filter`'
-how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft
-  Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events in your Splunk environment.
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the SignInLogs log category.
 known_false_positives: Although not recommended, certain users may be required without
   multi-factor authentication. Filter as needed
@@ -30,7 +30,7 @@ tags:
   asset_type: Azure Active Directory
   confidence: 90
   impact: 50
-  message: Successful authentication for user $body.properties.userPrincipalName$
+  message: Successful authentication for user $userPrincipalName$
     without MFA
   mitre_attack_id:
   - T1586
@@ -52,12 +52,12 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.category
-  - body.properties.authenticationRequirement
-  - body.properties.authenticationDetails
-  - body.properties.userPrincipalName
-  - body.properties.ipAddress
-  - body.properties.appDisplayName
+  - category
+  - properties.authenticationRequirement
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
+  - properties.appDisplayName
   risk_score: 45
   security_domain: identity
 tests:

detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml

@@ -1,8 +1,8 @@
 name: Azure AD Unusual Number of Failed Authentications From Ip
 id: 3d8d3a36-93b8-42d7-8d91-c5f24cec223d
-version: 1
+version: 2
 date: '2022-07-11'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: Anomaly
 description: 'The following analytic identifies one source Ip failing to authenticate
@@ -21,16 +21,18 @@ description: 'The following analytic identifies one source Ip failing to authent
   coverage. A similar analytic following the threshold model is `Azure AD Multiple
   Users Failing To Authenticate From Ip`.'
 data_source: []
-search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=50126
-  body.properties.authenticationDetails{}.succeeded= false | rename body.properties.*
-  as * | bucket span=5m _time | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName)
-  as tried_accounts by _time, ipAddress | eventstats  avg(unique_accounts) as ip_avg
-  , stdev(unique_accounts) as ip_std by ipAddress | eval  upperBound=(ip_avg+ip_std*3)
-  | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1,
-  0) | where isOutlier = 1 | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`'
-how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft
-  Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
-  You must be ingesting Azure Active Directory events in your Splunk environment.
+search: ' `azuread` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
+  | rename properties.* as *
+  | bucket span=5m _time
+  | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as userPrincipalName by _time, ipAddress
+  | eventstats  avg(unique_accounts) as ip_avg, stdev(unique_accounts) as ip_std by ipAddress
+  | eval  upperBound=(ip_avg+ip_std*3)
+  | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1,0)
+  | where isOutlier = 1 
+  | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
   Specifically, this analytic leverages the SignInLogs log category.
 known_false_positives: A source Ip failing to authenticate with multiple users is
   not a common for legitimate behavior.
@@ -45,7 +47,7 @@ tags:
   asset_type: Azure Active Directory
   confidence: 90
   impact: 60
-  message: Possible Password Spraying attack against Azure AD from source ip $body.properties.ipAddress$
+  message: Possible Password Spraying attack against Azure AD from source ip $ipAddress$
   mitre_attack_id:
   - T1586
   - T1586.003
@@ -67,17 +69,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.properties.status.errorCode
-  - body.category
-  - body.properties.authenticationDetails
-  - body.properties.userPrincipalName
-  - body.properties.ipAddress
+  - properties.status.errorCode
+  - category
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
   risk_score: 54
   security_domain: access
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/password_spraying_azuread/azuread_signin.log
     source: mscs:azure:eventhub
     sourcetype: mscs:azure:eventhub
     update_timestamp: true

detections/cloud/azure_ad_user_enabled_and_password_reset.yml

@@ -2,7 +2,7 @@ name: Azure AD User Enabled And Password Reset
 id: 1347b9e8-2daa-4a6f-be73-b421d3d9e268
 version: 1
 date: '2022-08-29'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic identifies an Azure AD user enabling a previously
@@ -10,12 +10,12 @@ description: The following analytic identifies an Azure AD user enabling a previ
   represent an adversary who has obtained administrative access and is trying to establish
   a backdoor identity within an Azure AD tenant.
 data_source: []
-search: ' `azuread` (body.operationName="Enable account" OR body.operationName="Reset
-  password (by admin)" OR body.operationName="Update user") | transaction body.properties.targetResources{}.userPrincipalName
-  startsWith=(body.operationName="Enable account") endsWith=(body.operationName="Reset
-  password (by admin)") maxspan=2m | rename body.properties.* as * | rename targetResources{}.userPrincipalName
+search: ' `azuread` (operationName="Enable account" OR operationName="Reset password (by admin)" 
+  OR operationName="Update user") | transaction properties.targetResources{}.userPrincipalName
+  startsWith=(operationName="Enable account") endsWith=(operationName="Reset password (by admin)") maxspan=2m 
+  | rename properties.* as * | rename targetResources{}.userPrincipalName
   as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy
-  | stats values(body.operationName) values(initiatedBy) by _time, userPrincipalName,
+  | stats values(operationName) values(initiatedBy) as initiatedBy by _time, userPrincipalName,
   result | `azure_ad_user_enabled_and_password_reset_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
@@ -31,17 +31,17 @@ tags:
   asset_type: Azure Active Directory
   confidence: 90
   impact: 50
-  message: A user account, $displayName$, was enabled and its password reset within
+  message: A user account, $userPrincipalName$, was enabled and its password reset within
     2 minutes by $initiatedBy$
   mitre_attack_id:
   - T1098
   observable:
-  - name: displayName
-    type: Other
+  - name: userPrincipalName
+    type: User Name
     role:
     - Victim
   - name: initiatedBy
-    type: User
+    type: User Name
     role:
     - Attacker
   product:
@@ -50,10 +50,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - body.operationName
-  - body.properties.targetResources{}.userPrincipalName
-  - body.properties.initiatedBy.user.userPrincipalName
-  - body.properties.result
+  - operationName
+  - properties.targetResources{}.userPrincipalName
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.result
   risk_score: 45
   security_domain: identity
 tests:

detections/cloud/azure_ad_user_immutableid_attribute_updated.yml

@@ -2,7 +2,7 @@ name: Azure AD User ImmutableId Attribute Updated
 id: 0c0badad-4536-4a84-a561-5ff760f3c00e
 version: 1
 date: '2022-09-02'
-author: Mauricio Velazco, Splunk
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic identifies the modification of the SourceAnchor
@@ -20,12 +20,12 @@ description: The following analytic identifies the modification of the SourceAnc
   to Azure AD impersonating any user and bypassing the requirement to have a valid
   password and/or perform MFA.
 data_source: []
-search: ' `azuread` body.operationName="Update user" body.properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor
-  | rename body.properties.* as * | rename targetResources{}.userPrincipalName as
+search: ' `azuread` operationName="Update user" properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor
+  | rename properties.* as * | rename targetResources{}.userPrincipalName as
   userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy | rename
-  body.callerIpAddress as callerIpAddress | rename targetResources{}.modifiedProperties{}.newValue
-  as modifiedProperties | stats values(userPrincipalName) values(modifiedProperties)
-  by _time, initiatedBy, callerIpAddress, result, body.operationName | `azure_ad_user_immutableid_attribute_updated_filter`'
+  callerIpAddress as callerIpAddress | rename targetResources{}.modifiedProperties{}.newValue
+  as modifiedProperties | stats values(userPrincipalName) as userPrincipalName values(modifiedProperties)
+  by _time, initiatedBy, callerIpAddress, result, operationName | `azure_ad_user_immutableid_attribute_updated_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
   You must be ingesting Azure Active Directory events into your Splunk environment.

detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml

@@ -31,7 +31,7 @@ tags:
   asset_type: AWS Instance
   confidence: 60
   impact: 70
-  message: User $user$ is modifying an instance $dest$ for the first time.
+  message: User $user$ is modifying an instance $object_id$ for the first time.
   mitre_attack_id:
   - T1078.004
   - T1078
@@ -40,10 +40,6 @@ tags:
     type: User
     role:
     - Attacker
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml

@@ -59,7 +59,7 @@ tags:
     type: IP Address
     role:
     - Attacker
-  - name: dest
+  - name: object
     type: Endpoint
     role:
     - Victim

detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml

@@ -46,10 +46,10 @@ tags:
   mitre_attack_id:
   - T1530
   observable:
-  - name: dest
-    type: Other
+  - name: remote_ip
+    type: IP Address
     role:
-    - Other
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/detect_s3_access_from_a_new_ip.yml

@@ -35,10 +35,10 @@ tags:
   mitre_attack_id:
   - T1530
   observable:
-  - name: dest
-    type: Other
+  - name: src_ip
+    type: IP Address
     role:
-    - Other
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml

@@ -17,9 +17,7 @@ description: The following analytic identifies multiple failed multi-factor auth
   and APT29 have leveraged this technique to bypass multi-factor authentication controls
   as reported by Mandiant and others.
 data_source: []
-search: ' `gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | bucket
-  span=5m _time | stats dc(_raw) AS mfa_prompts values(user) by src_ip, login_challenge_method,  _time
-  | where mfa_prompts >= 10 | `gcp_multiple_failed_mfa_requests_for_user_filter`'
+search: "`gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | bucket span=5m _time | stats dc(_raw) AS mfa_prompts values(user) AS user by src_ip, login_challenge_method,  _time | where mfa_prompts >= 10 | `gcp_multiple_failed_mfa_requests_for_user_filter`"
 how_to_implement: You must install the latest version of Splunk Add-on for Google
   Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows
   Splunk administrators to collect Google Workspace event data in Splunk using Google

detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml

@@ -38,14 +38,10 @@ tags:
   - T1048.003
   - T1048
   observable:
-  - name: source.address
-    type: User
+  - name: dest_domain
+    type: IP Address
     role:
     - Attacker
-  - name: destination{}.address
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/gsuite_suspicious_calendar_invite.yml

@@ -32,14 +32,14 @@ tags:
   asset_type: GSuite
   confidence: 50
   impact: 50
-  message: tbd
+  message: Gsuite suspicious calendar invite sent by $email$
   mitre_attack_id:
   - T1566
   observable:
-  - name: dest
-    type: Other
+  - name: email
+    type: Email Address
     role:
-    - Other
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/o365_add_app_role_assignment_grant_user.yml

@@ -36,11 +36,7 @@ tags:
   - T1136.003
   - T1136
   observable:
-  - name: ActorIpAddress
-    type: IP Address
-    role:
-    - Attacker
-  - name: Actor.ID
+  - name: UserId
     type: User
     role:
     - Attacker

detections/cloud/o365_disable_mfa.yml

@@ -30,14 +30,10 @@ tags:
   mitre_attack_id:
   - T1556
   observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
   - name: user
     type: User
     role:
-    - Attacker
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/active_setup_registry_autostart.yml

@@ -14,7 +14,7 @@ description: This analytic is to detect a suspicious modification of the active
   valid setup installer that creating or modifying this registry.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user 
   | `drop_dm_object_name(Registry)`
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`'

detections/endpoint/bitsadmin_download_file.yml

@@ -43,6 +43,7 @@ tags:
   - BITS Jobs
   - DarkSide Ransomware
   - Living Off The Land
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml

@@ -38,6 +38,7 @@ tags:
   - Living Off The Land
   - ProxyNotShell
   - CISA AA22-277A
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 100
   impact: 90

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -45,6 +45,7 @@ tags:
   - Living Off The Land
   - Azorult
   - Data Destruction
+  - Warzone RAT
   asset_type: Endpoint
   automated_detection_testing: passed
   confidence: 50

detections/endpoint/create_remote_thread_in_shell_application.yml

@@ -26,6 +26,7 @@ tags:
   analytic_story:
   - IcedID
   - Qakbot
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 100
   impact: 70

detections/endpoint/detect_certify_command_line_arguments.yml

@@ -0,0 +1,63 @@
+name: Detect Certify Command Line Arguments
+id: e6d2dc61-a8b9-4b03-906c-da0ca75d71b8
+version: 1
+date: '2023-06-25'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic identifies when the attacker tool Certify or Certipy are used to enumerate Active Directory Certificate Services (AD CS) environments. The default command line arguments of these tools are similar and perform near identical enumeration or exploitation functions.
+data_source:
+- Sysmon Event ID 1
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("* find *","* auth *","* request *","* req *","* download *",) AND Processes.process IN ("* /vulnerable*","* /enrolleeSuppliesSubject *","* /json /outfile*","* /ca*", "* -username *","* -u *") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `detect_certify_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
+known_false_positives:  Unknown
+references:
+- https://github.com/GhostPack/Certify
+- https://github.com/ly4k/Certipy
+- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  - Ingress Tool Transfer
+  asset_type: Endpoint
+  confidence: 90
+  impact: 100
+  message: Certify/Certipy arguments detected on $dest$.
+  mitre_attack_id:
+  - T1649
+  - T1105
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process
+    type: Process
+    role:
+    - Attacker
+  - name: process_name
+    type: Process Name
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id 
+  risk_score: 90
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

detections/endpoint/detect_certify_with_powershell_script_block_logging.yml

@@ -0,0 +1,69 @@
+name: Detect Certify With PowerShell Script Block Logging
+id: f533ca6c-9440-4686-80cb-7f294c07812a
+version: 1
+date: '2023-06-25'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic identifies when the attacker tool  Certify is used through an in-memory PowerShell function to enumerate Active Directory Certificate Services (AD CS) environments. The default command line arguments for the binary version of this tools are similar to PowerShell calls and perform near identical enumeration or exploitation functions.
+data_source:
+- Powershell 4104
+search: '`powershell` EventCode=4104 (ScriptBlockText IN ("*find *") AND ScriptBlockText IN ("* /vulnerable*","* -vulnerable*","* /enrolleeSuppliesSubject *","* /json /outfile*")) OR (ScriptBlockText IN (,"*auth *","*req *",) AND ScriptBlockText IN ("* -ca *","* -username *","* -u *")) OR (ScriptBlockText IN ("*request *","*download *") AND ScriptBlockText IN ("* /ca:*"))
+| stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command Values(OpCode) as reason values(Path) as file_name values(UserID) as user by _time Computer EventCode 
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| eval file_name = case(isnotnull(file_name),file_name,true(),"unknown")
+| eval signature = substr(command,0,256)
+| rename Computer as dest,EventCode as signature_id
+| `detect_certify_with_powershell_script_block_logging_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell..
+known_false_positives: Unknown, partial script block matches.  
+references:
+- https://github.com/GhostPack/Certify
+- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  - Malicious PowerShell
+  asset_type: Endpoint
+  confidence: 90
+  impact: 100
+  message: Certify arguments through PowerShell detected on $dest$.
+  mitre_attack_id:
+  - T1649
+  - T1059
+  - T1059.001
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: User Name
+    role:
+    - Victim
+  - name: command
+    type: Process
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - OpCode
+  - Path
+  - user
+  - Computer 
+  - EventCode
+  risk_score: 90
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

detections/endpoint/detect_webshell_exploit_behavior.yml

@@ -44,6 +44,7 @@ tags:
   - BlackByte Ransomware
   - CISA AA22-264A
   - Citrix ShareFile RCE CVE-2023-24489
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 80
   impact: 100

detections/endpoint/disable_etw_through_registry.yml

@@ -5,7 +5,7 @@ date: '2023-04-27'
 author: Steven Dick, Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: this search is to identify modification in registry to disable ETW windows
+description: This search is to identify modification in registry to disable ETW windows
   feature to evade detections. This technique was seen in several ransomware, RAT
   and even APT to impaire defenses of the compromise machine and to be able to execute
   payload with minimal alert as much as possible.
@@ -13,7 +13,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
-  Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path
+  Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.dest Registry.registry_path
   Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
   Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`'
@@ -32,7 +32,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: Disable ETW Through Registry
+  message: Disable ETW Through Registry on $dest$
   mitre_attack_id:
   - T1562.001
   - T1562

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -35,6 +35,7 @@ tags:
   - Suspicious Rundll32 Activity
   - Data Destruction
   - Volt Typhoon
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -61,6 +61,7 @@ tags:
   - Trickbot
   - Amadey
   - BlackByte Ransomware
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 50
   impact: 40

detections/endpoint/hide_user_account_from_sign_in_screen.yml

@@ -30,6 +30,7 @@ tags:
   - XMRig
   - Windows Registry Abuse
   - Azorult
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 80
   impact: 90

detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml

@@ -33,6 +33,7 @@ tags:
   - AgentTesla
   - RedLine Stealer
   - FIN7
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 70
   impact: 50

detections/endpoint/office_application_drop_executable.yml

@@ -39,6 +39,7 @@ tags:
   - FIN7
   - AgentTesla
   - CVE-2023-21716 Word RTF Heap Corruption
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/office_product_spawn_cmd_process.yml

@@ -44,6 +44,7 @@ tags:
   - AgentTesla
   - CVE-2023-21716 Word RTF Heap Corruption
   - CVE-2023-36884 Office and Windows HTML RCE Vulnerability
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 80
   impact: 70

detections/endpoint/overwriting_accessibility_binaries.yml

@@ -31,6 +31,7 @@ tags:
   - Data Destruction
   - Hermetic Wiper
   - Windows Privilege Escalation
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 90
   impact: 80

detections/endpoint/ping_sleep_batch_command.yml

@@ -34,6 +34,7 @@ tags:
   - Data Destruction
   - WhisperGate
   - BlackByte Ransomware
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 60
   impact: 60

detections/endpoint/powershell_4104_hunting.yml

@@ -59,6 +59,7 @@ tags:
   - Malicious PowerShell
   - Hermetic Wiper
   - Data Destruction
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/powershell_windows_defender_exclusion_commands.yml

@@ -34,6 +34,7 @@ tags:
   - Windows Defense Evasion Tactics
   - Data Destruction
   - WhisperGate
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -68,6 +68,7 @@ tags:
   - Amadey
   - Sneaky Active Directory Persistence Tricks
   - BlackByte Ransomware
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 95
   impact: 80

detections/endpoint/suspicious_copy_on_system32.yml

@@ -1,7 +1,7 @@
 name: Suspicious Copy on System32
 id: ce633e56-25b2-11ec-9e76-acde48001122
 version: 1
-date: '2021-10-05'
+date: '2023-08-17'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -12,14 +12,18 @@ description: This analytic is to detect a suspicious copy of file from systemroo
   but this is really a anomaly that needs to be check within the network.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe")
-  AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*")
-  AND Processes.process = "*copy*" by Processes.dest Processes.user Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
-  `suspicious_copy_on_system32_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.parent_process_name IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe")
+  AND `process_copy` AND Processes.process IN("*\\Windows\\System32\\*", "*\\Windows\\SysWow64\\*")
+  AND Processes.process = "*copy*" 
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id temp
+  | `drop_dm_object_name(Processes)` 
+  | eval splitted_commandline=split(process," ")
+  | eval first_cmdline=lower(mvindex(splitted_commandline,0))
+  | where NOT LIKE(first_cmdline,"%\\windows\\system32\\%") AND NOT LIKE(first_cmdline,"%\\windows\\syswow64\\%")
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  |`suspicious_copy_on_system32_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,

detections/endpoint/suspicious_process_file_path.yml

@@ -62,6 +62,7 @@ tags:
   - Trickbot
   - Amadey
   - BlackByte Ransomware
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 50
   impact: 70

detections/endpoint/system_processes_run_from_unexpected_locations.yml

@@ -39,6 +39,7 @@ tags:
   - Ransomware
   - Masquerading - Rename System Utilities
   - Qakbot
+  - Windows Error Reporting Service Elevation of Privilege Vulnerability
   asset_type: Endpoint
   confidence: 50
   impact: 60

detections/endpoint/unusually_long_command_line.yml

@@ -32,13 +32,13 @@ tags:
   asset_type: Endpoint
   confidence: 60
   impact: 70
-  message: Unusually long command line $Processes.process_name$ on $dest$
+  message: Unusually long command line $process_name$ on $dest$
   observable:
   - name: dest
     type: Endpoint
     role:
     - Victim
-  - name: Processes.process_name
+  - name: process_name
     type: Process
     role:
     - Attacker

detections/endpoint/w3wp_spawning_shell.yml

@@ -44,6 +44,7 @@ tags:
   - HAFNIUM Group
   - BlackByte Ransomware
   - CISA AA22-264A
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 80
   cve:

detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml

@@ -0,0 +1,76 @@
+name: Windows Bypass UAC via Pkgmgr Tool
+id: cce58e2c-988a-4319-9390-0daa9eefa3cd
+version: 1
+date: '2023-07-26'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon Event ID 1
+description: The following analytic identifies a potentially suspicious execution of the 'pkgmgr' process involving the use of an XML input file for package management.
+  The 'pkgmgr' process, though deprecated in modern Windows systems, was historically used for managing packages. The presence of an XML input file raises concerns about the nature of the executed command and its potential impact on the system.
+  Due to the deprecated status of 'pkgmgr' and the involvement of an XML file, this activity warrants careful investigation. XML files are commonly used for configuration and data exchange, making it crucial to ascertain the intentions and legitimacy of the command.
+  To ensure system security, it is recommended to use up-to-date package management utilities, such as DISM or PowerShell's PackageManagement module, and exercise caution when executing commands involving potentially sensitive operations or files.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where  Processes.process_name = pkgmgr.exe Processes.process = "*.xml*" NOT(Processes.parent_process_path IN("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "*:\\Program Files*"))
+  by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_bypass_uac_via_pkgmgr_tool_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be present on recent Windows Operating
+  Systems. Filtering may be required based on process_name. In addition, look for
+  non-standard, unsigned, module loads into LSASS. If query is too noisy, modify by
+  adding Endpoint.processes process_name to query to identify the process making the
+  modification.
+references:
+- https://asec.ahnlab.com/en/17692/
+- https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer.
+tags:
+  analytic_story:
+  - Warzone RAT
+  asset_type: Endpoint
+  confidence: 30
+  impact: 30
+  message: A pkgmgr.exe executed with package manager xml input file on $dest$
+  mitre_attack_id:
+  - T1548.002
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 9
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/pkgmgr_uac_bypass/pkgmgr_create_file.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - RedLine Stealer
   - Amadey
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - RedLine Stealer
   - Amadey
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/windows_defender_exclusion_registry_entry.yml

@@ -33,6 +33,7 @@ tags:
   - Windows Defense Evasion Tactics
   - Azorult
   - Qakbot
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/windows_iso_lnk_file_creation.yml

@@ -40,6 +40,7 @@ tags:
   - IcedID
   - Azorult
   - Remcos
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 50
   impact: 80

detections/endpoint/windows_mark_of_the_web_bypass.yml

@@ -0,0 +1,62 @@
+name: Windows Mark Of The Web Bypass
+id: 8ca13343-7405-4916-a2d1-ae34ce0c28ae
+version: 1
+date: '2023-08-14'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 23
+description: The following analytic identifies a suspicious process that delete mark-of-the-web data stream. 
+  This technique has been observed in various instances of malware and adversarial activities aimed at circumventing 
+  security restrictions within the Windows Operating System, particularly pertaining to files downloaded from the internet. 
+  An example of this scenario is demonstrated by Ave Maria RAT, which attempts to delete this data stream as a means to evade such restrictions.
+search: '`sysmon` EventCode=23 TargetFilename = "*:Zone.Identifier" 
+  | stats  min(_time) as firstTime max(_time) as lastTime count by user EventCode Image TargetFilename ProcessID Computer | rename Computer as dest
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_mark_of_the_web_bypass_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the deleted target file name, 
+  process name and process id  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: unknown
+references:
+- https://attack.mitre.org/techniques/T1553/005/
+- https://github.com/nmantani/PS-MOTW#remove-motwps1
+tags:
+  analytic_story:
+  - Warzone RAT
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: A mark-of-the-web data stream is deleted on $dest$
+  mitre_attack_id:
+  - T1553.005
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - EventCode
+  - TargetFilename
+  - Computer
+  - user
+  - Image
+  - ProcessID
+  - _time
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/possible-motw-deletion.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_mimikatz_binary_execution.yml

@@ -38,6 +38,7 @@ tags:
   - CISA AA22-320A
   - Sandworm Tools
   - Volt Typhoon
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 100
   impact: 100

detections/endpoint/windows_modify_registry_maxconnectionperserver.yml

@@ -0,0 +1,65 @@
+name: Windows Modify Registry MaxConnectionPerServer
+id: 064cd09f-1ff4-4823-97e0-45c2f5b087ec
+version: 1
+date: '2023-07-26'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
+description: The following analytic identifies a suspicious registry modification of Windows max connection per server configuration. 
+  This particular technique has been observed in various threat actors, adversaries, and even in malware such as the Warzone (Ave Maria) RAT.
+  By altering the max connection per server setting in the Windows registry, attackers can potentially increase the number of concurrent connections 
+  allowed to a remote server. This modification could be exploited for various malicious purposes, including facilitating distributed denial-of-service (DDoS) attacks or enabling more effective lateral movement within a compromised network.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server*")  Registry.registry_value_data = "0x0000000a" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_modify_registry_maxconnectionperserver_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: Administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://asec.ahnlab.com/en/17692/
+- https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer.
+tags:
+  analytic_story:
+  - Warzone RAT
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A registry modification in max connection per server configuration in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 25
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/maxconnectionperserver/registry_event.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_phishing_recent_iso_exec_registry.yml

@@ -40,6 +40,7 @@ tags:
   - IcedID
   - Azorult
   - Remcos
+  - Warzone RAT
   asset_type: Endpoint
   confidence: 80
   impact: 50

detections/endpoint/windows_process_injection_remote_thread.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Qakbot
   - Graceful Wipe Out Attack
+  - Warzone RAT
   asset_type: 80
   confidence: 80
   impact: 80

detections/endpoint/windows_process_injection_wermgr_child_process.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Qakbot
+  - Windows Error Reporting Service Elevation of Privilege Vulnerability
   asset_type: Endpoint
   confidence: 70
   impact: 80

detections/endpoint/windows_service_created_with_suspicious_service_path.yml

@@ -33,6 +33,7 @@ tags:
   - Brute Ratel C4
   - Qakbot
   - Snake Malware
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 80
   impact: 70

detections/endpoint/windows_sql_spawning_certutil.yml

@@ -0,0 +1,58 @@
+name: Windows SQL Spawning CertUtil
+id: dfc18a5a-946e-44ee-a373-c0f60d06e676
+version: 1
+date: '2023-08-25'
+author: Michael Haag, Splunk
+status: experimental
+type: TTP
+data_source:
+- Sysmon Event ID 1
+description: 'The following analytic detects the use of certutil to download software, a behavior exhibited by the threat actor Flax Typhoon. This actor deploys a VPN connection by downloading an executable file for SoftEther VPN from their network infrastructure using one of several LOLBins, including certutil. The actor then uses the Service Control Manager (SCM) to create a Windows service that launches the VPN connection automatically when the system starts. This behavior allows the actor to monitor the availability of the compromised system and establish an RDP connection. This analytic identifies this behavior by monitoring for the use of certutil in conjunction with the downloading of software. This behavior is worth identifying for a SOC as it indicates a potential compromise of the system and the establishment of a persistent threat. If a true positive is found, it suggests an attacker has gained access to the environment and is attempting to maintain that access, potentially leading to further malicious activities such as data theft or ransomware attacks. Be aware of potential false positives - legitimate uses of certutil in your environment may cause benign activities to be flagged. Upon triage, review the command executed and look for concurrent processes to identify the attack source. This approach helps analysts detect potential threats earlier and mitigate the risks.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("sqlservr.exe", "sqlagent.exe", "sqlps.exe", "launchpad.exe", "sqldumper.exe") `process_certutil` (Processes.process=*urlcache* Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_sql_spawning_certutil_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: The occurrence of false positives should be minimal, given that the SQL agent does not typically download software using CertUtil.
+references:
+- https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/
+tags:
+  analytic_story:
+  - Flax Typhoon
+  asset_type: Endpoint
+  atomic_guid: []
+  confidence: 100
+  impact: 90
+  message: '$process_name$ was launched on $dest$ by $user$. This behavior is uncommon with the SQL process identified.'
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Target
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 90
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.original_file_name
+  - Processes.parent_process_id
+  security_domain: endpoint

detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml

@@ -0,0 +1,97 @@
+name: Windows Steal Authentication Certificates - ESC1 Authentication
+id: f0306acf-a6ab-437a-bbc6-8628f8d5c97e
+version: 1
+date: '2023-05-25'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic identifies when a suspicious certificate is granted using Active Directory Certificate Services (AD CS) with a Subject Alternative Name (SAN) and then immediately used for authentication. This action alone may not be malicious, however improperly configured certificate templates can be abused to permit privilege escalation and environment compromise due to over permissive settings (AD CS ESC1).
+data_source:
+  - Windows Security 4887
+  - Windows Security 4768
+search: >-
+  `wineventlog_security` EventCode IN (4887) Attributes="*SAN:*upn*" Attributes="*CertificateTemplate:*"
+  | stats count min(_time) as firstTime max(_time) as lastTime values(name) as name values(status) as status values(Subject) as ssl_subject values(SubjectKeyIdentifier) as ssl_hash by Computer, EventCode, Requester, Attributes, RequestId
+  | rex field=Attributes "(?i)CertificateTemplate:(?<object>[^\r\n]+)"
+  | rex field=Attributes "(?i)ccm:(?<req_src>[^\r\n]+)"
+  | rex max_match=10 field=Attributes "(?i)(upn=(?<req_user_1>[^\r\n&]+))"
+  | rex max_match=10 field=Attributes "(?i)(dns=(?<req_dest_1>[^\r\n&]+))"
+  | rex field=Requester "(.+\\\\)?(?<src_user>[^\r\n]+)"
+  | rename Attributes as object_attrs, EventCode as signature_id, name as signature, RequestId as ssl_serial, Requester as ssl_subject_common_name
+  | eval user = lower(coalesce(req_user_1,req_user_2)) 
+  | join user
+  [
+  | search `wineventlog_security` EventCode=4768 CertThumbprint=*
+  | rename TargetUserName as user, Computer as auth_dest, IpAddress as auth_src
+  | fields auth_src,auth_dest,user
+  ]
+  | eval src = upper(coalesce(auth_src,req_src)), dest = upper(coalesce(auth_dest,req_dest_1,req_dest_2)), risk_score = 90
+  | eval flavor_text = case(signature_id=="4887", "User account [".'user'."] authenticated after a suspicious certificate was issued for it by [".'src_user'."] using certificate request ID: ".'ssl_serial')
+  | fields - req_* auth_*
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_steal_authentication_certificates___esc1_authentication_filter`
+how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference. Recommend throttle correlation by RequestId/ssl_serial at minimum.
+known_false_positives: False positives may be generated in environments where administrative users or processes are allowed to generate certificates with Subject Alternative Names for authentication. Sources or templates used in these processes may need to be tuned out for accurate function.
+references:
+  - https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
+  - https://github.com/ly4k/Certipy#esc1
+  - https://pentestlaboratories.com/2021/11/08/threat-hunting-certificate-account-persistence/
+tags:
+  analytic_story:
+    - Windows Certificate Services
+  asset_type: Endpoint
+  confidence: 90
+  impact: 100
+  message: Possible AD CS ESC1 authentication on $dest$
+  mitre_attack_id:
+    - T1649
+    - T1550
+  observable:
+    - name: src
+      type: Hostname
+      role:
+        - Victim
+    - name: dest
+      type: Hostname
+      role:
+        - Victim
+    - name: src_user
+      type: User Name
+      role:
+        - Victim
+    - name: user
+      type: User Name
+      role:
+        - Victim
+    - name: ssl_hash
+      type: Other
+      role:
+        - Attacker
+    - name: ssl_serial
+      type: Other
+      role:
+        - Attacker
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - _time
+    - Attributes
+    - Computer
+    - EventCode
+    - Requester
+    - RequestId
+    - TargetUserName
+    - Computer
+    - IpAddress
+  risk_score: 90
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_winsecurity.log
+        source: XmlWinEventLog:Security
+        sourcetype: XmlWinEventLog
+        update_timestamp: true

detections/endpoint/windows_suspect_process_with_authentication_traffic.yml

@@ -0,0 +1,86 @@
+name: Windows Suspect Process With Authentication Traffic
+id: 953322db-128a-4ce9-8e89-56e039e33d98
+version: 1
+date: '2023-06-13'
+author: Steven Dick
+status: production
+type: Anomaly
+description: >-
+  This analytic identifies executables running from public or temporary locations that are communicating over windows domain
+  authentication ports/protocol. The ports/protocols include LDAP(389), LDAPS(636), and Kerberos(88). Authentications from applications 
+  running from user controlled locations may not be malicious, however actors often attempt to access domain resources after initial 
+  compromise from executables in these locations.
+data_source:
+  - Sysmon Event ID 3
+search: >-
+  | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id 
+  from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("88","389","636") 
+  AND All_Traffic.app IN ("*\\users\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") 
+  by All_Traffic.app,All_Traffic.src,All_Traffic.src_ip,All_Traffic.user,All_Traffic.dest,All_Traffic.dest_ip,All_Traffic.dest_port
+  | `drop_dm_object_name(All_Traffic)` 
+  | rex field=app ".*\\\(?<process_name>.*)$"
+  | rename app as process
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_suspect_process_with_authentication_traffic_filter`
+how_to_implement: >-
+  To implement this analytic, Sysmon should be installed in the environment and generating network events for 
+  userland and/or known public writable locations.
+known_false_positives: >-
+  Known applications running from these locations for legitimate purposes. Targeting only kerberos (port 88)
+  may significantly reduce noise.
+references:
+  - Most attacker toolkits offer some degree of interaction with AD/LDAP.
+  - https://attack.mitre.org/techniques/T1069/002/
+  - https://book.hacktricks.xyz/network-services-pentesting/pentesting-kerberos-88 
+tags:
+  analytic_story:
+    - Active Directory Discovery
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: The process $process_name$ on $src$ has been communicating with $dest$ on $dest_port$.
+  mitre_attack_id:
+    - T1087
+    - T1087.002
+    - T1204
+    - T1204.002
+  observable:
+    - name: src
+      type: Hostname
+      role:
+        - Victim
+    - name: dest
+      type: Hostname
+      role:
+        - Victim
+    - name: user
+      type: User Name
+      role:
+        - Victim
+    - name: process_name
+      type: Other
+      role:
+        - Attacker
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - _time
+    - All_Traffic.app
+    - All_Traffic.src
+    - All_Traffic.src_ip
+    - All_Traffic.user
+    - All_Traffic.dest
+    - All_Traffic.dest_ip
+    - All_Traffic.dest_port
+  risk_score: 25
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon.log
+        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+        sourcetype: xmlwineventlog
+        update_timestamp: true

detections/endpoint/windows_unsigned_dll_side_loading.yml

@@ -0,0 +1,68 @@
+name: Windows Unsigned DLL Side-Loading
+id: 5a83ce44-8e0f-4786-a775-8249a525c879
+version: 1
+date: '2023-07-26'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon Event ID 7
+description: This analysis focuses on detecting potentially malicious unsigned DLLs created in either the c:\windows\system32 or c:\windows\syswow64 folders. 
+  This particular technique was observed in the context of the Warzone (Ave Maria) RAT, where it employed a method known as DLL hijacking (dll-side-loading) 
+  by dropping the "dismcore.dll" to achieve privilege escalation.
+  DLL hijacking is a stealthy attack technique used by cybercriminals to exploit the way Windows searches and loads DLLs. By placing a malicious DLL with the 
+  same name as one that a legitimate application is expected to load, the attacker can gain unauthorized access and execute malicious code.
+  In the case of Warzone RAT (Ave Maria), the dropped "dismcore.dll" was intended to deceive the system into loading the rogue DLL instead of the legitimate version, 
+  thereby granting the malware elevated privileges and enabling further compromise of the target system.
+  Detecting such suspicious DLLs is crucial in preventing privilege escalation attacks and other potential security breaches. Regular security assessments, thorough monitoring, 
+  and implementing security best practices are essential in safeguarding systems from such threats.
+search: '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name Computer EventCode ProcessId Hashes IMPHASH | rename Computer as dest
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_unsigned_dll_side_loading_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. 
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: It is possible some Administrative utilities will load dismcore.dll outside of normal system paths, filter as needed.
+references:
+- https://asec.ahnlab.com/en/17692/
+- https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer.
+tags:
+  analytic_story:
+  - Warzone RAT
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: An unsigned dll module was loaded on $dest$
+  mitre_attack_id:
+  - T1574.002
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Image 
+  - ImageLoaded 
+  - Signed 
+  - SignatureStatus 
+  - OriginalFileName 
+  - process_name 
+  - Computer 
+  - EventCode 
+  - ProcessId 
+  - Hashes 
+  - IMPHASH 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml

@@ -40,6 +40,7 @@ tags:
   - Ryuk Ransomware
   - CISA AA22-257A
   - Scheduled Tasks
+  - Windows Error Reporting Service Elevation of Privilege Vulnerability
   asset_type: Endpoint
   confidence: 100
   impact: 70

detections/endpoint/winrar_spawning_shell_application.yml

@@ -0,0 +1,71 @@
+name: WinRAR Spawning Shell Application
+id: d2f36034-37fa-4bd4-8801-26807c15540f
+version: 1
+date: '2023-08-29'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 1
+description: The following analytic detects the execution of Windows shell processes initiated by WinRAR, specifically looking for instances where WinRAR spawns processes like "cmd.exe", "powershell.exe", "certutil.exe", "mshta.exe", or "bitsadmin.exe". This behavior is worth identifying for a Security Operations Center (SOC) because it is indicative of a spoofing attack exploit, such as the one associated with WinRAR CVE-2023-38831. Cybercriminals exploited this vulnerability to craft ZIP archives with spoofed extensions, hiding the launch of malicious scripts within an archive. When a victim opened the specially crafted archive, it executed the malware, leading to unauthorized access to their broker accounts and enabling the cybercriminals to perform illicit financial transactions and withdraw funds. If a true positive is found, it suggests that an attacker has successfully exploited the vulnerability to execute malicious scripts, leading to unauthorized access, financial loss, and potentially the delivery of additional malicious payloads. The impact of the attack could be severe, involving financial loss, unauthorized access to sensitive accounts, and the potential for further malicious activity such as data theft or ransomware attacks.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winrar.exe `windows_shells` OR
+  Processes.process_name IN ("certutil.exe","mshta.exe","bitsadmin.exe")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winrar_spawning_shell_application_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: Be aware of potential false positives - legitimate uses of WinRAR and the listed processes in your environment may cause benign activities to be flagged. Upon triage, review the destination, user, parent process, and process name involved in the flagged activity. Capture and inspect any relevant on-disk artifacts, and look for concurrent processes to identify the attack source. This approach helps analysts detect potential threats earlier and mitigate the risks.
+references:
+- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
+- https://github.com/BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc
+- https://github.com/b1tg/CVE-2023-38831-winrar-exploit
+tags:
+  analytic_story:
+  - WinRAR Spoofing Attack CVE-2023-38831
+  cve:
+  - CVE-2023-38831
+  asset_type: endpoint
+  atomic_guid: []
+  confidence: 70
+  impact: 100
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 70
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/winrar.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/web/adobe_coldfusion_access_control_bypass.yml

@@ -0,0 +1,64 @@
+name: Adobe ColdFusion Access Control Bypass
+id: d6821c0b-fcdc-4c95-a77f-e10752fae41a
+version: 1
+date: '2023-08-23'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic detects potential exploitation attempts against Adobe ColdFusion vulnerabilities CVE-2023-29298 and CVE-2023-26360. These vulnerabilities pertain to an access control bypass and an arbitrary file read due to deserialization, respectively. By monitoring for requests to specific ColdFusion Administrator endpoints, especially those with an unexpected additional forward slash, the analytic identifies attempts to bypass access controls. Such behavior is crucial for a Security Operations Center (SOC) to identify, as exploitation can grant unauthorized access to ColdFusion administration endpoints, potentially leading to information leakage, brute force attacks, or further exploitation of other vulnerabilities. If a true positive is detected, it indicates a serious security breach where an attacker might have gained privileged access to the ColdFusion environment, potentially leading to data theft or other malicious activities. SOCs must be vigilant in monitoring for these patterns, ensuring timely detection and response to such threats, thus safeguarding the integrity and security of their ColdFusion deployments.
+search: '| tstats count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Web where Web.url IN ("//restplay*", "//CFIDE/restplay*", "//CFIDE/administrator*", "//CFIDE/adminapi*", "//CFIDE/main*", "//CFIDE/componentutils*", "//CFIDE/wizards*", "//CFIDE/servermanager*","/restplay*", "/CFIDE/restplay*", "/CFIDE/administrator*", "/CFIDE/adminapi*", "/CFIDE/main*", "/CFIDE/componentutils*", "/CFIDE/wizards*", "/CFIDE/servermanager*") Web.status=200
+  by Web.http_user_agent, Web.status, Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `adobe_coldfusion_access_control_bypass_filter`'
+how_to_implement: This detection requires the Web datamodel to be populated from a
+  supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk
+  for Palo Alto.
+known_false_positives: This analytic is limited to HTTP Status 200; adjust as necessary. False positives may occur if the URI path is IP-restricted or externally blocked. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
+references:
+- https://www.rapid7.com/blog/post/2023/07/11/cve-2023-29298-adobe-coldfusion-access-control-bypass/
+tags:
+  cve:
+  - CVE-2023-29298
+  analytic_story:
+  - Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360
+  asset_type: Network
+  atomic_guid: []
+  confidence: 50
+  impact: 90
+  message: Possible exploitation of CVE-2023-29298 against $dest$. 
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 45
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  - Web.status
+  - sourcetype
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/adobe/coldfusion_cve_2023_29298.log
+    source: suricata
+    sourcetype: suricata

detections/web/adobe_coldfusion_unauthenticated_arbitrary_file_read.yml

@@ -0,0 +1,69 @@
+name: Adobe ColdFusion Unauthenticated Arbitrary File Read
+id: 695aceae-21db-4e7f-93ac-a52e39d02b93
+version: 1
+date: '2023-08-23'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic detects potential exploitation of the critical Adobe ColdFusion vulnerability, CVE-2023-26360. This flaw, rooted in the deserialization of untrusted data, enables Unauthenticated Arbitrary File Read. Exploitation often targets specific ColdFusion paths, especially related to CKEditor's file manager. \
+
+  Our analytic pinpoints exploitation by monitoring web requests to the "/cf_scripts/scripts/ajax/ckeditor/*" path. This focus helps differentiate malicious activity from standard ColdFusion traffic. For SOCs, detecting such attempts is vital given the vulnerability's CVSS score of 9.8, signaling its severity. Successful exploitation can lead to unauthorized data access, further attacks, or severe operational disruptions. \
+
+  If a true positive arises, it indicates an active breach attempt, potentially causing data theft, operational disruption, or reputational damage. In essence, this analytic provides a targeted approach to identify attempts exploiting a high-risk ColdFusion vulnerability. While false positives may occur from legitimate accesses, any alerts should be treated as high-priority, warranting immediate investigation to ensure security.
+search: '| tstats count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Web where Web.url IN ("/cf_scripts/scripts/ajax/ckeditor/*") Web.status=200
+  by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `adobe_coldfusion_unauthenticated_arbitrary_file_read_filter`'
+how_to_implement: This detection requires the Web datamodel to be populated from a
+  supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk
+  for Palo Alto.
+known_false_positives: 'In the wild, we have observed three different types of attempts that could potentially trigger false positives if the HTTP status code is not in the query. Please check this github gist for the specific URIs : https://gist.github.com/patel-bhavin/d10830f3f375a2397233f6a4fe38d5c9 . These could be legitimate requests depending on the context of your organization. Therefore, it is recommended to modify the analytic as needed to suit your specific environment.'
+references:
+- https://www.rapid7.com/db/modules/auxiliary/gather/adobe_coldfusion_fileread_cve_2023_26360/
+- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26360.yaml
+tags:
+  cve:
+  - CVE-2023-26360
+  analytic_story:
+  - Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360
+  asset_type: Network
+  atomic_guid: []
+  confidence: 50
+  impact: 90
+  message: Possible exploitation of CVE-2023-26360 against $dest$. 
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 45
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  - Web.status
+  - sourcetype
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/adobe/cve_2023_29360_coldfusion.log
+    source: suricata
+    sourcetype: suricata

detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml

@@ -0,0 +1,60 @@
+name: Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082
+id: e03edeba-4942-470c-a664-27253f3ad351
+version: 1
+date: '2023-08-08'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source: []
+description: 'The following analytic detects potential unauthorized access attempts exploiting CVE-2023-35082 within Ivantis software products. Initially assessed to affect only MobileIron Core versions up to 11.2, further insights revealed its influence extending to Ivanti Endpoint Manager Mobile (EPMM) versions 11.10, 11.9, 11.8, and MobileIron Core 11.7 and below. The vulnerability facilitates unauthorized API access via the specific URI path /mifs/asfV3/api/v2/. The analytic identifies this behavior by monitoring web access logs for this URI pattern coupled with a HTTP 200 response code, signifying successful unauthorized access. \
+  Such behavior is imperative for a Security Operations Center (SOC) to recognize, as it highlights potential security breaches which, if not addressed, could lead to unauthorized data access, system modifications, or further exploitation. In the event of a true positive, the implications are severe: an attacker might have gained unbridled access to sensitive organizational data or could modify systems maliciously. Be vigilant of potential false positives; benign activities might occasionally match the pattern. During triage, closely scrutinize the source of the access request and its subsequent actions. This analytic aids analysts in early threat detection, allowing for proactive risk mitigation.'
+search: '| tstats count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Web where Web.url IN ("/mifs/asfV3/api/v2/*") Web.status=200
+  by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082_filter`'
+how_to_implement: To implement this analytic, a network product similar to Suricata or Palo Alto needs to be mapped to the Web datamodel. Modify accordingly to work with your products.
+known_false_positives: Similar to CVE-2023-35078, the path for exploitation indicates that status=200 is required for successful exploitation of the vulnerability. False positives may be present if status=200 is removed from the search.  If it is removed,then the search also alert on status=301 and status=404 which indicates unsuccessful exploitation attempts.  Analysts may find it useful to hunt for these status codes as well, but it is likely to produce a significant number of alerts as this is a widespread vulnerability.
+references:
+- https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US
+- https://github.com/vchan-in/CVE-2023-35078-Exploit-POC/blob/main/cve_2023_35078_poc.py
+- https://www.rapid7.com/blog/post/2023/08/02/cve-2023-35082-mobileiron-core-unauthenticated-api-access-vulnerability/
+tags:
+  analytic_story:
+  - Ivanti EPMM Remote Unauthenticated Access
+  asset_type: Web Server
+  cve:
+  - CVE-2023-35082
+  atomic_guid: []
+  confidence: 80
+  impact: 80
+  message: Potential CVE-2023-35082 against an Ivanti EPMM appliance on $dest$.
+  mitre_attack_id:
+  - T1190
+  - T1133
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 64
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_CVE202335082.log
+    source: suricata
+    sourcetype: suricata
+

detections/web/ivanti_sentry_authentication_bypass.yml

@@ -0,0 +1,63 @@
+name: Ivanti Sentry Authentication Bypass
+id: b8e0d1cf-e6a8-4d46-a5ae-aebe18ead8f8
+version: 1
+date: '2023-08-24'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source: []
+description: This analytic is designed to detect unauthenticated access to the System Manager Portal in Ivanti Sentry, formerly known as MobileIron Sentry. The vulnerability, designated as CVE-2023-38035, affects all supported versions 9.18, 9.17, and 9.16, as well as older versions. The analytic works by monitoring for changes in the configuration of Sentry and the underlying operating system. Such changes could indicate an attacker attempting to execute OS commands as root. This behavior is of significant concern for a Security Operations Center (SOC) as it presents a substantial security risk, particularly if port 8443, the default port for the System Manager Portal, is exposed to the internet. If the analytic returns a true positive, it suggests that an attacker has gained unauthorized access to the Sentry system, potentially leading to a significant system compromise and data breach. It is important to note that while the issue has a high CVSS score, the risk of exploitation is low for customers who do not expose port 8443 to the internet. The search specifically looks for HTTP requests to certain endpoints ("/mics/services/configservice/*", "/mics/services/*","/mics/services/MICSLogService*") and HTTP status code of 200. Unusual or unexpected patterns in these parameters could indicate an attack.
+search: '| tstats count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Web where Web.url IN ("/mics/services/configservice/*", "/mics/services/*","/mics/services/MICSLogService*") Web.status=200
+  by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `ivanti_sentry_authentication_bypass_filter`'
+how_to_implement: To implement this analytic, a network product similar to Suricata or Palo Alto needs to be mapped to the Web datamodel. Modify accordingly to work with your products.
+known_false_positives: It is important to note that false positives may occur if the search criteria are expanded beyond the HTTP status code 200. In other words, if the search includes other HTTP status codes, the likelihood of encountering false positives increases. This is due to the fact that HTTP status codes other than 200 may not necessarily indicate a successful exploitation attempt.
+references:
+- https://github.com/horizon3ai/CVE-2023-38035/blob/main/CVE-2023-38035.py
+- https://www.horizon3.ai/ivanti-sentry-authentication-bypass-cve-2023-38035-deep-dive/
+- https://forums.ivanti.com/s/article/KB-API-Authentication-Bypass-on-Sentry-Administrator-Interface-CVE-2023-38035?language=en_US
+tags:
+  analytic_story:
+  - Ivanti Sentry Authentication Bypass CVE-2023-38035
+  cve:
+  - CVE-2023-38035
+  asset_type: Network
+  atomic_guid: []
+  confidence: 50
+  impact: 90
+  message: Possible exploitation of CVE-2023-38035 against $dest$. 
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 45
+  required_fields:
+  - Web.http_user_agent
+  - Web.status
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - sourcetype
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/ivanti/ivanti_sentry_CVE_2023_38035.log
+    source: suricata
+    sourcetype: suricata

detections/web/juniper_networks_remote_code_execution_exploit_detection.yml

@@ -0,0 +1,70 @@
+name: Juniper Networks Remote Code Execution Exploit Detection
+id: 6cc4cc3d-b10a-4fac-be1e-55d384fc690e
+version: 1
+date: '2023-08-29'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic detects the exploitation of a remote code execution vulnerability in Juniper Networks devices. The vulnerability involves multiple steps, including uploading a malicious PHP file and an INI file to the target server, and then executing the PHP code by manipulating the PHP configuration via the uploaded INI file. The analytic specifically looks for requests to /webauth_operation.php?PHPRC=*, which are used to upload the files and execute the code, respectively. This behavior is worth identifying for a SOC because it indicates that an attacker is attempting to exploit the vulnerability to gain unauthorized access to the device and execute arbitrary code. If a true positive is found, it suggests that an attacker has successfully exploited the vulnerability and may have gained control over the device, leading to data theft, network compromise, or other damaging outcomes. Upon triage, review the request parameters and the response to determine if the exploitation was successful. Capture and inspect any relevant network traffic and server logs to identify the attack source. This approach helps analysts detect potential threats earlier and mitigate the risks.
+search: '| tstats count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Web where Web.url IN ("*/webauth_operation.php?PHPRC=*") Web.status=200
+  by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `juniper_networks_remote_code_execution_exploit_detection_filter`'
+how_to_implement: To implement this search, ensure that the Web data model is populated. The search is activated when the Web data model is accelerated. Network products, such as Suricata or Palo Alto, need to be mapped to the Web data model. Adjust the mapping as necessary to suit your specific products.
+known_false_positives: Be aware of potential false positives - legitimate uses of the /webauth_operation.php endpoint may cause benign activities to be flagged.The URL in the analytic is specific to a successful attempt to exploit the vulnerability. Review contents of the HTTP body to determine if the request is malicious. If the request is benign, add the URL to the whitelist or continue to monitor.
+references:
+- https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US
+- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36844.yaml
+- https://thehackernews.com/2023/08/new-juniper-junos-os-flaws-expose.html
+- https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844
+- https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/
+tags:
+  analytic_story:
+  - Juniper JunOS Remote Code Execution
+  cve:
+  - CVE-2023-36844
+  - CVE-2023-36845
+  - CVE-2023-36846
+  - CVE-2023-36847
+  asset_type: Web server
+  atomic_guid: []
+  confidence: 80
+  impact: 90
+  message: 'This analytic has identified a potential exploitation of a remote code execution vulnerability in Juniper Networks devices on $dest$ on the URL $url$ used for the exploit.'
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: url
+    type: URL String
+    role:
+    - Attacker
+  mitre_attack_id:
+  - T1190
+  - T1105
+  - T1059
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 72
+  required_fields:
+  - Web.http_user_agent
+  - Web.status
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - sourcetype
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/juniper/suricata_junos_cvemegazord.log
+    source: suricata
+    sourcetype: suricata

dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -1,6 +1,6 @@
 name: Attempted Credential Dump From Registry via Reg exe
 id: 14038953-e5f2-4daf-acff-5452062baf03
-version: 2
+version: 3
 date: '2021-11-29'
 author: Jose Hernandez, Splunk
 status: production