From c3e7e4c8501b60e6ba5c4ab028d8e961f180a507 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 14 Apr 2022 13:40:01 -0600
Subject: [PATCH 1/3] Update
 ssa___windows_lolbin_binary_in_non_standard_path.yml

---
 ..._windows_lolbin_binary_in_non_standard_path.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 3666dac81f..e619bd2d73 100644
--- a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint_Processes
 description: The following analytic identifies native living off the land binaries within the Windows
   operating system that may be abused by adversaries by moving it to a new directory.
-  The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
+  The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe, regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
 search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
   "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
   "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
@@ -16,13 +16,13 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
-  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR process_name="cmd.exe" OR 
-  process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="csc.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
-  process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="explorer.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
-  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="hh.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe" OR 
+  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
+  process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
+  process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
+  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe" OR 
   process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
   process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
-  process_name="reg.exe" OR process_name="regedit.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
+  process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
   process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
 
   | from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
@@ -88,4 +88,4 @@ tags:
   risk_score: 49
   risk_severity: medium
   security_domain: endpoint
-  asset_type: Endpoint
+  asset_type: Endpoint
\ No newline at end of file

From 79ee477a193d5dce2b55e1d5feadd3c79289de38 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 14 Apr 2022 14:04:13 -0600
Subject: [PATCH 2/3] comsvcs

---
 ...ssa___windows_rundll32_comsvcs_memory_dump.yml} | 14 ++++++++------
 ..._windows_rundll32_comsvcs_memory_dump.test.yml} |  6 +++---
 2 files changed, 11 insertions(+), 9 deletions(-)
 rename detections/endpoint/{ssa___detect_dump_lsass_memory_using_comsvcs.yml => ssa___windows_rundll32_comsvcs_memory_dump.yml} (91%)
 rename tests/endpoint/{ssa___detect_dump_lsass_memory_using_comsvcs.test.yml => ssa___windows_rundll32_comsvcs_memory_dump.test.yml} (65%)

diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
similarity index 91%
rename from detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
rename to detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
index 3f541dc5f2..c5666a2b5a 100644
--- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+++ b/detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
@@ -1,7 +1,7 @@
-name: Detect Dump LSASS Memory using comsvcs
+name: Windows Rundll32 Comsvcs Memory Dump
 id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
-version: 2
-date: '2021-11-29'
+version: 4
+date: '2022-04-14'
 author: Jose Hernandez, Splunk
 type: TTP
 datamodel:
@@ -15,7 +15,9 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
   "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
   null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
   "event_id"), "string", null) | where process IS NOT NULL AND process_name IS NOT
-  NULL AND process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
+  NULL AND process_name LIKE "%rundll32.exe%"
+  AND match_regex(process, /(?i)MiniDump[\s;]+/)=true
+  AND match_regex(process, /(?i)comsvcs.dll\s+/)=true 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine),
   body=create_map(["event_id", event_id, "process_name", process_name, "process",
   process]) | into write_ssa_detected_events();'
@@ -41,7 +43,7 @@ tags:
   - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
-  impact: 70
+  impact: 40
   kill_chain_phases:
   - Actions on Objectives
   message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$
@@ -68,6 +70,6 @@ tags:
   - _time
   - dest_device_id
   - process
-  risk_score: 70
+  risk_score: 40
   risk_severity: medium
   security_domain: endpoint
diff --git a/tests/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.test.yml b/tests/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.test.yml
similarity index 65%
rename from tests/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.test.yml
rename to tests/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.test.yml
index d71522e2d3..53a645020b 100644
--- a/tests/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.test.yml
+++ b/tests/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.test.yml
@@ -1,7 +1,7 @@
-name: Detect Dump LSASS Memory using comsvcs Unit Test
+name: Windows Rundll32 Comsvcs Memory Dump Unit Test
 tests:
-- name: Detect Dump LSASS Memory using comsvcs
-  file: endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+- name: Windows Rundll32 Comsvcs Memory Dump
+  file: endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
   pass_condition: '@count_gt(0)'
   description: Test credential dumping detections
   attack_data:

From b356157dc0eb316e0db951cf5a4f091830d66298 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 14 Apr 2022 14:13:22 -0600
Subject: [PATCH 3/3] Update ssa___windows_rundll32_comsvcs_memory_dump.yml

---
 .../ssa___windows_rundll32_comsvcs_memory_dump.yml       | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
index c5666a2b5a..ea923fda05 100644
--- a/detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
+++ b/detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
@@ -6,9 +6,9 @@ author: Jose Hernandez, Splunk
 type: TTP
 datamodel:
 - Endpoint_Processes
-description: The following analytic identifies credential dumping using comsvcs.dll
-  with `regsvr32.exe`. This technique is common with adversaries who would like to
-  dump the memory of lsass.exe and perform offline password cracking.
+description: The following analytic identifies memory dumping using comsvcs.dll with the minidump function
+  with `rundll32.exe`. This technique is common with adversaries who would like to
+  dump the memory of lsass.exe.
 search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
   "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
   "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - Suspicious Rundll32 Activity
   asset_type: Endpoint
   cis20:
   - CIS 8
@@ -46,7 +47,7 @@ tags:
   impact: 40
   kill_chain_phases:
   - Actions on Objectives
-  message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$
+  message: A dump of a process was attempted using comsvcs.dll with the minidump function on endpoint $dest_device_id$
     by user $dest_device_user$.
   mitre_attack_id:
   - T1003.003