Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm

baselines/previously_seen_command_line_arguments.yml

@@ -28,6 +28,7 @@ tags:
   - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
   - Suspicious Command-Line Executions
   - Suspicious MSHTA Activity
+  - Icedid
   detections:
   - Detect Prohibited Applications Spawning cmd.exe
   - Processes launching netsh

detections/endpoint/account_discovery_with_net_app.yml

@@ -29,9 +29,11 @@ known_false_positives: admin or power user may used this series of command.
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/
 - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+- https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/
 tags:
   analytic_story:
   - Trickbot
+  - Icedid
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/chcp_command_execution.yml

@@ -0,0 +1,68 @@
+name: CHCP Command Execution
+id: 21d236ec-eec1-11eb-b23e-acde48001122
+version: 1
+date: '2021-07-27'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect execution of chcp.exe application. this utility
+  is used to change the active code page of the console. This technique was seen in
+  icedid malware to know the locale region/language/country of the compromise host.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com
+  Processes.parent_process_name = cmd.exe Processes.parent_process=*/c* by  Processes.process_name
+  Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id
+  Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed chcp.com may be used.
+known_false_positives: other tools or script may used this to change code page to
+  UTF-* or others
+references:
+- https://ss64.com/nt/chcp.html
+- https://twitter.com/tccontre18/status/1419941156633329665?s=20
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1059
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process
+  - parent_process_name
+  - parent_process
+  - process_id
+  - parent_process_id
+  - dest
+  - user
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Recon
+  message: parent process $parent_process_name$ spawning chcp process $process_name$
+    with parent command line $parent_process$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/create_remote_thread_in_shell_application.yml

@@ -0,0 +1,64 @@
+name: Create Remote Thread In Shell Application
+id: 10399c1e-f51e-11eb-b920-acde48001122
+version: 1
+date: '2021-08-04'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect suspicious process injection in command shell.
+  This technique was seen in IcedID where it execute cmd.exe process to inject its
+  shellcode as part of its execution as banking trojan. It is really uncommon to have
+  a create remote thread execution in the following application.
+search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") | stats
+  count min(_time) as firstTime max(_time) as lastTime by  TargetImage TargetProcessId
+  SourceProcessId  EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage
+  - TargetImage
+  - TargetProcessId
+  - SourceProcessId
+  - StartAddress
+  - EventCode
+  - Computer
+  security_domain: endpoint
+  impact: 70
+  confidence: 100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: process $SourceImage$ create a remote thread to shell app process $TargetImage$
+    in host $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/detect_html_help_renamed.yml

@@ -5,7 +5,7 @@ date: '2021-02-11'
 author: Michael Haag, Splunk
 type: batch
 datamodel:
-  - Endpoint
+- Endpoint
 description: The following analytic identifies a renamed instance of hh.exe (HTML
   Help) executing a Compiled HTML Help (CHM). This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any
@@ -21,12 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=HH.exe
   AND Processes.process_name!=hh.exe) by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.original_file_name 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `detect_html_help_renamed_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Although unlikely a renamed instance of hh.exe will be used
   legitimately, filter as needed.
 references:
@@ -49,7 +50,8 @@ tags:
   impact: 80
   kill_chain_phases:
   - Actions on Objectives
-  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$.
+  message: The following $process_name$ has been identified as renamed, spawning from
+    $parent_process_name$.
   mitre_attack_id:
   - T1218.001
   nist:
@@ -80,11 +82,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

detections/endpoint/drop_icedid_license_dat.yml

@@ -0,0 +1,55 @@
+name: Drop IcedID License dat
+id: b7a045fc-f14a-11eb-8e79-acde48001122
+version: 1
+date: '2021-07-30'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect dropping a suspicious file named as "license.dat"
+  in %appdata%. This behavior seen in latest IcedID malware that contain the actual
+  core bot that will be injected in other process to do banking stealing.
+search: '`sysmon` EventCode= 11  TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*"
+  OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time)
+  as lastTime by TargetFilename EventCode process_id  process_name Computer | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+references:
+- https://www.cisecurity.org/white-papers/security-primer-icedid/
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1204.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 70
+  confidence: 90
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: process $SourceImage$ create a file $TargetImage$ in host $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/eventvwr_uac_bypass.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Icedid
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/fodhelper_uac_bypass.yml

@@ -37,6 +37,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Icedid
   automated_detection_testing: passed
   confidence: 90
   context:

detections/endpoint/icedid_exfiltrated_archived_file_creation.yml

@@ -0,0 +1,60 @@
+name: IcedID Exfiltrated Archived File Creation
+id: 0db4da70-f14b-11eb-8043-acde48001122
+version: 1
+date: '2021-07-30'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious file creation namely passff.tar
+  and cookie.tar. This files are possible archived of stolen browser information like
+  history and cookies in a compromised machine with IcedID.
+search: '`sysmon` EventCode= 11  (TargetFilename = "*\\passff.tar" OR TargetFilename
+  = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by
+  TargetFilename EventCode process_id  process_name Computer | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://www.cisecurity.org/white-papers/security-primer-icedid/
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1560.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - TargetFilename
+  - EventCode
+  - process_id
+  - process_name
+  - Computer
+  security_domain: endpoint
+  impact: 80
+  confidence: 90
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  message: process $SourceImage$ create a file $TargetImage$ in host $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml

@@ -27,6 +27,7 @@ references:
 tags:
   analytic_story:
   - Trickbot
+  - Icedid
   confidence: 80
   context:
   - source:endpoint

detections/endpoint/nltest_domain_trust_discovery.yml

@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - Ryuk Ransomware
   - Domain Trust Discovery
+  - Icedid
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/office_application_spawn_regsvr32_process.yml

@@ -0,0 +1,64 @@
+name: Office Application Spawn Regsvr32 process
+id: 2d9fc90c-f11f-11eb-9300-acde48001122
+version: 1
+date: '2021-07-30'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this detection was designed to identifies suspicious spawned process
+  of known MS office application due to macro or malicious code. this technique can
+  be seen in so many malware like Icedid that used MS office as its weapon or attack
+  vector to initially infect the machines.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
+  = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name
+  = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") Processes.process_name=regsvr32.exe
+  by Processes.parent_process_name Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
+  | `office_application_spawn_regsvr32_process_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://www.joesandbox.com/analysis/380662/0/html
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_guid
+  - Processes.user
+  - Processes.dest
+  security_domain: endpoint
+  impact: 70
+  confidence: 90
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: Office application spawning regsvr32.exe on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/office_application_spawn_rundll32_process.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Spearphishing Attachments
   - Trickbot
+  - Icedid
   automated_detection_testing: passed
   confidence: 90
   context:

detections/endpoint/office_document_executing_macro_code.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Spearphishing Attachments
   - Trickbot
+  - Icedid
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/office_product_spawning_mshta.yml

@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - Icedid
   automated_detection_testing: passed
   confidence: 90
   context:

detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml

@@ -11,7 +11,7 @@ description: The following analytic identifies suspicious PowerShell script exec
   adversary will map all running security applications or services. During triage,
   review parallel processes within the same timeframe. Review the full script block
   to identify other related artifacts.
-search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*"
+search: '`powershell` EventCode=4104 (Message = "*SELECT*" OR Message = "*WMIC*") AND (Message = "*AntiVirusProduct*"
   OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time)
   as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`'

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -36,6 +36,7 @@ tags:
   - Ransomware
   - Windows Persistence Techniques
   - 'Emotet Malware  DHS Report TA18-201A '
+  - Icedid
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/rundll32_create_remote_thread_to_a_process.yml

@@ -0,0 +1,64 @@
+name: Rundll32 Create Remote Thread To A Process
+id: 2dbeee3a-f067-11eb-96c0-acde48001122
+version: 1
+date: '2021-07-29'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe
+  process to cmd.exe process . This technique was seen in IcedID malware to execute
+  its malicious code in normal process for defense evasion and to steal sensitive
+  information the the compromised host. browser process.
+search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe"
+  | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage
+  TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the SourceImage, TargetImage, and EventCode executions from your endpoints
+  related to create remote thread or injecting codes. If you are using Sysmon, you
+  must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: unknown
+references:
+- https://www.joesandbox.com/analysis/380662/0/html
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage
+  - TargetImage
+  - TargetProcessId
+  - SourceProcessId
+  - StartAddress
+  - EventCode
+  - Computer
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$
+    in host $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/rundll32_createremotethread_in_browser.yml

@@ -0,0 +1,65 @@
+name: Rundll32 CreateRemoteThread In Browser
+id: f8a22586-ee2d-11eb-a193-acde48001122
+version: 1
+date: '2021-07-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe
+  process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID
+  malware where it hooks the browser to parse banking information as user used the
+  targetted browser process.
+search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe",
+  "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time)
+  as firstTime max(_time) as lastTime by SourceImage TargetImage TargetProcessId SourceProcessId
+  StartAddress EventCode Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `rundll32_createremotethread_in_browser_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the SourceImage, TargetImage, and EventCode executions from your endpoints
+  related to create remote thread or injecting codes. If you are using Sysmon, you
+  must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: unknown
+references:
+- https://www.joesandbox.com/analysis/380662/0/html
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage
+  - TargetImage
+  - TargetProcessId
+  - SourceProcessId
+  - StartAddress
+  - EventCode
+  - Computer
+  security_domain: endpoint
+  impact: 70
+  confidence: 100
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: rundl32 process $SourceImage$ create a remote thread to browser process
+    $TargetImage$ in host $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/rundll32_dnsquery.yml

@@ -0,0 +1,64 @@
+name: Rundll32 DNSQuery
+id: f1483f5e-ee29-11eb-9d23-acde48001122
+version: 1
+date: '2021-07-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious rundll32.exe process having a http
+  connection and do a dns query in some web domain. This technique was seen in IcedID
+  malware where the rundll32 that execute its payload will contact amazon.com to check
+  internet connect and to communicate to its C&C server to download config and other
+  file component.
+search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time)
+  as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId direction
+  Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `rundll32_dnsquery_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and eventcode = 22 dnsquery executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+references:
+- https://any.run/malware-trends/icedid
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - QueryName
+  - QueryStatus
+  - ProcessId
+  - direction
+  - Computer
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: rundll32 process $process_name$ having a dns query to $QueryName$ in host
+    $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/rundll32_process_creating_exe_dll_files.yml

@@ -0,0 +1,61 @@
+name: Rundll32 Process Creating Exe Dll Files
+id: 6338266a-ee2a-11eb-bf68-acde48001122
+version: 1
+date: '2021-07-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious rundll32 process that drops executable
+  (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries
+  to drop copy of itself in temp folder or download executable drop it either appdata
+  or programdata as part of its execution.
+search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe",
+  "*.dll",) | stats count min(_time) as firstTime max(_time) as lastTime by Image
+  TargetFilename ProcessGuid dest user_id | `security_content_ctime(firstTime)` |
+  `security_content_ctime(lastTime)` | `rundll32_process_creating_exe_dll_files_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, TargetFilename, and eventcode 11 executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+references:
+- https://any.run/malware-trends/icedid
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - TargetFilename
+  - ProcessGuid
+  - dest
+  - user_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/schedule_task_with_rundll32_command_trigger.yml

@@ -35,6 +35,7 @@ tags:
   analytic_story:
   - Windows Persistence Techniques
   - Trickbot
+  - Icedid
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/sqlite_module_in_temp_folder.yml

@@ -0,0 +1,62 @@
+name: Sqlite Module In Temp Folder
+id: 0f216a38-f45f-11eb-b09c-acde48001122
+version: 1
+date: '2021-08-03'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious file creation of sqlite3.dll in
+  %temp% folder. This behavior was seen in IcedID malware where it download sqlite
+  module to parse browser database like for chrome or firefox to stole browser information
+  related to bank, credit card or credentials.
+search: '`sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename
+  = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") |stats count min(_time) as
+  firstTime max(_time) as lastTime by process_name TargetFilename EventCode ProcessId
+  Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `sqlite_module_in_temp_folder_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://www.cisecurity.org/white-papers/security-primer-icedid/
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - TargetFilename
+  - EventCode
+  - ProcessId
+  - Image
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  message: process $SourceImage$ create a file $TargetImage$ in host $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml

@@ -0,0 +1,67 @@
+name: Suspicious IcedID Regsvr32 Cmdline
+id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122
+version: 1
+date: '2021-07-27'
+author: Teoderick Contreras,
+type: batch
+datamodel:
+- Endpoint
+description: this search is to detect a suspicious regsvr32 commandline "-s" to execute
+  a dll files. This technique was seen in IcedID malware to execute its initial downloader
+  dll that will download the 2nd stage loader that will download and decrypt the config
+  payload.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe
+  Processes.process=*-s* by  Processes.process_name Processes.process Processes.parent_process_name
+  Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_icedid_regsvr32_cmdline_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed regsvr32.exe may be used.
+known_false_positives: minimal. but network operator can use this application to load
+  dll.
+references:
+- https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.010
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process
+  - parent_process_name
+  - parent_process
+  - process_id
+  - parent_process_id
+  - dest
+  - user
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: regsvr32 process $process_name$ with commandline $process$ in host $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/suspicious_icedid_rundll32_cmdline.yml

@@ -0,0 +1,66 @@
+name: Suspicious IcedID Rundll32 Cmdline
+id: bed761f8-ee29-11eb-8bf3-acde48001122
+version: 1
+date: '2021-07-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious rundll32.exe commandline to execute
+  dll file. This technique was seen in IcedID malware to load its payload dll with
+  the following parameter to load encrypted dll payload which is the license.dat.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*/i:* by  Processes.process_name Processes.process Processes.parent_process_name
+  Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_icedid_rundll32_cmdline_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: limitted. this parameter is not commonly used by windows application
+  but can be used by the network operator.
+references:
+- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process
+  - parent_process_name
+  - parent_process
+  - process_id
+  - parent_process_id
+  - dest
+  - user
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: rundll32 process $process_name$ with commandline $process$ in host $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
+  - Iceid
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/suspicious_rundll32_plugininit.yml

@@ -0,0 +1,66 @@
+name: Suspicious Rundll32 PluginInit
+id: 92d51712-ee29-11eb-b1ae-acde48001122
+version: 1
+date: '2021-07-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious rundll32.exe process with plugininit
+  parameter. This technique is commonly seen in IceID malware to execute its initial
+  dll stager to download another payload to the compromised machine.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*PluginInit* by  Processes.process_name Processes.process Processes.parent_process_name
+  Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: third party application may used this dll export name to execute
+  function.
+references:
+- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process
+  - parent_process_name
+  - parent_process
+  - process_id
+  - parent_process_id
+  - dest
+  - user
+  security_domain: endpoint
+  impact: 60
+  confidence: 70
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: rundll32 process $process_name$ with commandline $process$ in host $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -46,6 +46,7 @@ tags:
   - Windows Persistence Techniques
   - Ransomware
   - Ryuk Ransomware
+  - Icedid
   automated_detection_testing: passed
   confidence: 100
   context:

stories/Icedid.yml

@@ -0,0 +1,25 @@
+name: Icedid
+id: 1d2cc747-63d7-49a9-abb8-93aa36305603
+version: 1
+date: '2021-07-29'
+author: Teoderick Contreras, Splunk
+type: batch
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the IcedID banking trojan, including looking for file writes associated
+  with its payload, process injection, shellcode execution and data collection.
+narrative: IcedId banking trojan campaigns targeting banks and other vertical sectors.This malware is known
+  in Microsoft Windows OS targetting browser such as firefox and chrom to steal banking information. It is also known
+  to its unique payload downloaded in C2 where it can be a .png file that hides the core shellcode bot using steganography technique or
+  gzip dat file that contains "license.dat" which is the actual core icedid bot.
+references:
+- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
+- https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/
+tags:
+  analytic_story: Icedid
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/chcp_command_execution.test.yml

@@ -0,0 +1,14 @@
+name: CHCP Command Execution Unit Test
+tests:
+- name: CHCP Command Execution
+  file: endpoint/chcp_command_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+    

tests/endpoint/create_remote_thread_in_shell_application.test.yml

@@ -0,0 +1,12 @@
+name: Create Remote Thread In Shell Application Unit Test
+tests:
+- name: Create Remote Thread In Shell Application
+  file: endpoint/create_remote_thread_in_shell_application.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/drop_icedid_license_dat.test.yml

@@ -0,0 +1,12 @@
+name: Drop IcedID License dat Unit Test
+tests:
+- name: Drop IcedID License dat
+  file: endpoint/drop_icedid_license_dat.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml

@@ -0,0 +1,12 @@
+name: IcedID Exfiltrated Archived File Creation Unit Test
+tests:
+- name: IcedID Exfiltrated Archived File Creation
+  file: endpoint/icedid_exfiltrated_archived_file_creation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/office_application_spawn_regsvr32_process.test.yml

@@ -0,0 +1,12 @@
+name: Office Application Spawn Regsvr32 process Unit Test
+tests:
+- name: Office Application Spawn Regsvr32 process
+  file: endpoint/office_application_spawn_regsvr32_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml

@@ -0,0 +1,12 @@
+name: Rundll32 Create Remote Thread To A Process Unit Test
+tests:
+- name: Rundll32 Create Remote Thread To A Process
+  file: endpoint/rundll32_create_remote_thread_to_a_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rundll32_createremotethread_in_browser.test.yml

@@ -0,0 +1,12 @@
+name: Rundll32 CreateRemoteThread In Browser Unit Test
+tests:
+- name: Rundll32 CreateRemoteThread In Browser
+  file: endpoint/rundll32_createremotethread_in_browser.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rundll32_dnsquery.test.yml

@@ -0,0 +1,12 @@
+name: Rundll32 DNSQuery Unit Test
+tests:
+- name: Rundll32 DNSQuery
+  file: endpoint/rundll32_dnsquery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rundll32_process_creating_exe_dll_files.test.yml

@@ -0,0 +1,12 @@
+name: Rundll32 Process Creating Exe Dll Files Unit Test
+tests:
+- name: Rundll32 Process Creating Exe Dll Files
+  file: endpoint/rundll32_process_creating_exe_dll_files.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/sqlite_module_in_temp_folder.test.yml

@@ -0,0 +1,12 @@
+name: Sqlite Module In Temp Folder Unit Test
+tests:
+- name: Sqlite Module In Temp Folder
+  file: endpoint/sqlite_module_in_temp_folder.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious IcedID Regsvr32 Cmdline Unit Test
+tests:
+- name: Suspicious IcedID Regsvr32 Cmdline
+  file: endpoint/suspicious_icedid_regsvr32_cmdline.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious IcedID Rundll32 Cmdline Unit Test
+tests:
+- name: Suspicious IcedID Rundll32 Cmdline
+  file: endpoint/suspicious_icedid_rundll32_cmdline.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_rundll32_plugininit.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious Rundll32 PluginInit Unit Test
+tests:
+- name: Suspicious Rundll32 PluginInit
+  file: endpoint/suspicious_rundll32_plugininit.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog