Branch was auto-updated.

detections/endpoint/attacker_tools_on_endpoint.yml

@@ -30,6 +30,7 @@ tags:
   - XMRig
   - SamSam Ransomware
   - Unusual Processes
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 2

detections/endpoint/deleting_shadow_copies.yml

@@ -30,6 +30,7 @@ tags:
   - SamSam Ransomware
   - Ransomware
   - Clop Ransomware
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_mimikatz_using_loaded_images.yml

@@ -31,6 +31,7 @@ tags:
   - Cloud Federated Credential Abuse
   - DarkSide Ransomware
   - CISA AA22-257A
+  - CISA AA22-264A
   asset_type: Windows
   cis20:
   - CIS 6

detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml

@@ -37,6 +37,7 @@ tags:
   analytic_story:
   - Hermetic Wiper 
   - Malicious PowerShell
+  - CISA AA22-264A
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -29,6 +29,7 @@ tags:
   - Living Off The Land
   - Industroyer2
   - CISA AA22-257A
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/excessive_usage_of_taskkill.yml

@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - XMRig
   - Azorult
+  - CISA AA22-264A
   - AgentTesla
   confidence: 70
   context:

detections/endpoint/office_product_spawning_windows_script_host.yml

@@ -0,0 +1,72 @@
+name: Office Product Spawning Windows Script Host
+id: b3628a5b-8d02-42fa-a891-eebf2351cbe1
+version: 1
+date: '2022-09-26'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic will identify a Windows Office Product spawning WScript.exe or CScript.exe. Tuning may be required based on legitimate application usage that may spawn scripts from an Office product.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name IN ("wscript.exe", "cscript.exe")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `office_product_spawning_windows_script_host_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present based on macro based approved documents in the organization. Filtering may be needed.
+references:
+  - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: office parent process $parent_process_name$ will execute a suspicious child
+    process $process_name$ on host $dest$.
+  mitre_attack_id:
+  - T1566
+  - T1566.001
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 63
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  asset_type: Endpoint

detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml

@@ -0,0 +1,64 @@
+name: Powershell COM Hijacking InprocServer32 Modification
+id: ea61e291-af05-4716-932a-67faddb6ae6f
+version: 1
+date: '2022-09-26'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell ScriptBlock Logging to identify a script that is attempting to modify or add a component object model to inprocserver32 path within the registry.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Software\\Classes\\CLSID\\*\\InProcServer32*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `powershell_com_hijacking_inprocserver32_modification_filter`'
+how_to_implement: The following analytic requires PowerShell operational logs
+  to be imported. Modify the PowerShell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: False positives will be present if any scripts are adding to inprocserver32. Filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1546/015/
+  - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
+  - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-powershell.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  - Installation
+  message: A PowerShell script has been identified with InProcServer32 within the script code on $Computer$.
+  mitre_attack_id:
+  - T1546.015
+  - T1059
+  - T1059.001
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
+  - EventCode
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/rundll_loading_dll_by_ordinal.yml

@@ -28,7 +28,8 @@ known_false_positives: False positives are possible with native utilities and th
   party applications. Filtering may be needed based on command-line, or add world
   writeable paths to restrict query.
 references:
-- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
+  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
+  - https://twitter.com/M_haggis/status/1491109262428635136
 tags:
   analytic_story:
   - Unusual Processes

detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml

@@ -39,6 +39,7 @@ tags:
   - Ransomware
   - Clop Ransomware
   - Insider Threat
+  - CISA AA22-264A
   cis20:
   - CIS 8
   - CIS 13

detections/endpoint/w3wp_spawning_shell.yml

@@ -39,6 +39,7 @@ tags:
   - HAFNIUM Group
   - ProxyShell
   - CISA AA22-257A
+  - CISA AA22-264A
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml

@@ -0,0 +1,72 @@
+name: Windows COM Hijacking InprocServer32 Modification
+id: b7bd83c0-92b5-4fc7-b286-23eccfa2c561
+version: 1
+date: '2022-09-26'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of reg.exe performing an add to the InProcServer32, which may be related to COM hijacking.
+  Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_reg`
+  Processes.process=*inprocserver32* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_com_hijacking_inprocserver32_modification_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present and some filtering may be required.
+references:
+  - https://attack.mitre.org/techniques/T1546/015/
+  - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to modify InProcServer32 within the registry.
+  mitre_attack_id:
+  - T1546.015
+  - T1546
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - UPDATE
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_disableantispyware_reg.yml

@@ -32,6 +32,7 @@ tags:
   - Windows Defense Evasion Tactics
   - Windows Registry Abuse
   - Azorult
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/windows_event_log_cleared.yml

@@ -28,6 +28,7 @@ tags:
   - Windows Log Manipulation
   - Ransomware
   - Clop Ransomware
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_possible_credential_dumping.yml

@@ -45,6 +45,7 @@ tags:
   - Detect Zerologon Attack
   - DarkSide Ransomware
   - CISA AA22-257A
+  - CISA AA22-264A
   automated_detection_testing: passed
   confidence: 80
   context:

detections/endpoint/windows_raw_access_to_disk_volume_partition.yml

@@ -29,6 +29,7 @@ tags:
   - Caddy Wiper
   - Data Destruction
   - Hermetic Wiper
+  - CISA AA22-264A
   cis20:
   - CIS 3
   - CIS 5

detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml

@@ -32,6 +32,7 @@ tags:
   - Caddy Wiper
   - WhisperGate
   - Hermetic Wiper
+  - CISA AA22-264A
   cis20:
   - CIS 3
   - CIS 5

detections/endpoint/windows_system_file_on_disk.yml

@@ -21,6 +21,7 @@ references:
 tags:
   analytic_story:
   - Windows Drivers
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml

@@ -0,0 +1,83 @@
+name: Windows System Script Proxy Execution Syncappvpublishingserver
+id: 8dd73f89-682d-444c-8b41-8e679966ad3c
+version: 1
+date: '2022-09-26'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the abuse of Syncappvpublishingserver.vbs, which is a native script on Windows that may be utilized to download remote files or perform privilege escalation.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("wscript.exe","cscript.exe")
+  Processes.process="*syncappvpublishingserver.vbs*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_system_script_proxy_execution_syncappvpublishingserver_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present if the vbscript syncappvpublishingserver is used for legitimate purposes. Filter as needed. Adding a n; to the command-line arguments may help reduce any noise.
+references:
+  - https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1216/T1216.md#atomic-test-1---syncappvpublishingserver-signed-script-powershell-command-execution
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download files or evade critical controls.
+  mitre_attack_id:
+  - T1216
+  - T1218
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 30
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/experimental/endpoint/exchange_powershell_module_usage.yml

@@ -1,8 +1,8 @@
 name: Exchange PowerShell Module Usage
 id: 2d10095e-05ae-11ec-8fdf-acde48001122
-version: 2
-date: '2022-05-02'
-author: Michael Haag
+version: 3
+date: '2022-09-22'
+author: Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: 'The following analytic identifies the usage of Exchange PowerShell modules
@@ -18,9 +18,12 @@ description: 'The following analytic identifies the usage of Exchange PowerShell
 
   Module - New-managementroleassignment can assign a management role to a management
   role group, management role assignment policy, user, or universal security group
-  (USG).'
-search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by lastTime by Opcode Computer
+  (USG). \
+  
+  Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \
+  Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).'
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*", "*New-MailboxSearch*", "*Get-Recipient*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer
   UserID EventCode ScriptBlockText| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `exchange_powershell_module_usage_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -29,14 +32,18 @@ how_to_implement: To successfully implement this analytic, you will need to enab
 known_false_positives: Administrators or power users may use this PowerShell commandlet
   for troubleshooting.
 references:
-- https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
-- https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
-- https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
-- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
-- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
+  - https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
+  - https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
+  - https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
+  - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+  - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
+  - https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
+  - https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps
+  - https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps
 tags:
   analytic_story:
   - ProxyShell
+  - CISA AA22-264A
   asset_type: Endpoint
   confidence: 50
   context:

lookups/attacker_tools.csv

@@ -25,3 +25,4 @@ NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Au
 ns.exe,A commonly used tool used by attackers to scan and map file shares
 SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
 kportscan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking Forums to perform network scanning on the internal networks.
+advanced_port_scanner.exe, Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports.

requirements.txt

@@ -12,7 +12,7 @@ PyYAML==5.4.1
 questionary==1.10.0
 requests==2.28.1
 six==1.16.0
-splunk-appinspect==2.25.0
+splunk-appinspect==2.26.0
 splunk-sdk==1.7.2
 wrapt-timeout-decorator==1.3.12.2
 xmltodict==0.13.0

stories/cisa_aa22_264a.yml

@@ -0,0 +1,22 @@
+name: CISA AA22-264A
+id: bc7056a5-c3b0-4b83-93ce-5f31739305c8
+version: 1
+date: '2022-09-22'
+author: Michael Haag, Splunk
+description: Iranian State Actors Conduct Cyber Operations Against the Government of Albania.
+narrative: The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory to provide information on recent cyber operations against the Government of Albania in July and September. This advisory provides a timeline of activity observed, from initial access to execution of encryption and wiper attacks. Additional information concerning files used by the actors during their exploitation of and cyber attack against the victim organization is provided in Appendices A and B. In September 2022, Iranian cyber actors launched another wave of cyber attacks against the Government of Albania, using similar TTPs and malware as the cyber attacks in July. These were likely done in retaliation for public attribution of the cyber attacks in July and severed diplomatic ties between Albania and Iran.
+
+references:
+  - https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
+  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-264a-iranian-cyber-actors-conduct-cyber-operations-against-the-government-of-albania.pdf
+  - https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against 
+  - https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/ 
+tags:
+  analytic_story: CISA AA22-264A
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/office_product_spawning_windows_script_host.test.yml

@@ -0,0 +1,13 @@
+name: Office Product Spawning Windows Script Host Unit Test
+tests:
+- name: Office Product Spawning Windows Script Host
+  file: endpoint/office_product_spawning_windows_script_host.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/powershell_com_hijacking_inprocserver32_modification.test.yml

@@ -0,0 +1,14 @@
+name: Powershell COM Hijacking InprocServer32 Modification Unit
+  Test
+tests:
+- name: Powershell COM Hijacking InprocServer32 Modification
+  file: endpoint/powershell_com_hijacking_inprocserver32_modification.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_com_hijacking_inprocserver32_modification.test.yml

@@ -0,0 +1,13 @@
+name: Windows COM Hijacking InprocServer32 Modification Unit Test
+tests:
+- name: Windows COM Hijacking InprocServer32 Modification
+  file: endpoint/windows_com_hijacking_inprocserver32_modification.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.test.yml

@@ -0,0 +1,13 @@
+name: Windows System Script Proxy Execution Syncappvpublishingserver Unit Test
+tests:
+- name: Windows System Script Proxy Execution Syncappvpublishingserver
+  file: endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true