From 98f46d7043a35e109ab82853c34873b19f6de52a Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 22 Sep 2022 09:25:52 -0600
Subject: [PATCH 01/13] CISA AA22-264A

---
 .../endpoint/attacker_tools_on_endpoint.yml   |  1 +
 .../endpoint/deleting_shadow_copies.yml       |  1 +
 .../detect_mimikatz_using_loaded_images.yml   |  1 +
 ...z_with_powershell_script_block_logging.yml |  1 +
 .../endpoint/dump_lsass_via_comsvcs_dll.yml   |  1 +
 .../endpoint/excessive_usage_of_taskkill.yml  |  1 +
 .../rundll_loading_dll_by_ordinal.yml         |  3 +-
 .../ssa___wevtutil_usage_to_clear_logs.yml    |  1 +
 detections/endpoint/w3wp_spawning_shell.yml   |  1 +
 .../windows_disableantispyware_reg.yml        |  1 +
 .../endpoint/windows_event_log_cleared.yml    |  1 +
 .../windows_possible_credential_dumping.yml   |  1 +
 ...ws_raw_access_to_disk_volume_partition.yml |  1 +
 ...raw_access_to_master_boot_record_drive.yml |  1 +
 .../endpoint/windows_system_file_on_disk.yml  |  1 +
 .../exchange_powershell_module_usage.yml      | 27 +++++++++++-------
 lookups/attacker_tools.csv                    |  1 +
 stories/cisa_aa22_264a.yml                    | 28 +++++++++++++++++++
 18 files changed, 62 insertions(+), 11 deletions(-)
 create mode 100644 stories/cisa_aa22_264a.yml

diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml
index 440f547927..2457cacd52 100644
--- a/detections/endpoint/attacker_tools_on_endpoint.yml
+++ b/detections/endpoint/attacker_tools_on_endpoint.yml
@@ -30,6 +30,7 @@ tags:
   - XMRig
   - SamSam Ransomware
   - Unusual Processes
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 2
diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml
index 8faef989cf..f0763e4b7f 100644
--- a/detections/endpoint/deleting_shadow_copies.yml
+++ b/detections/endpoint/deleting_shadow_copies.yml
@@ -30,6 +30,7 @@ tags:
   - SamSam Ransomware
   - Ransomware
   - Clop Ransomware
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 8
diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml
index 94612a9d97..48979bdb09 100644
--- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml
+++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml
@@ -31,6 +31,7 @@ tags:
   - Cloud Federated Credential Abuse
   - DarkSide Ransomware
   - CISA AA22-257A
+  - CISA AA22-264A
   asset_type: Windows
   cis20:
   - CIS 6
diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
index 25c7312764..78e28d2b75 100644
--- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
@@ -37,6 +37,7 @@ tags:
   analytic_story:
   - Hermetic Wiper 
   - Malicious PowerShell
+  - CISA AA22-264A
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
index f9668aa825..ca038a2efd 100644
--- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
+++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
@@ -29,6 +29,7 @@ tags:
   - Living Off The Land
   - Industroyer2
   - CISA AA22-257A
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml
index 22c82d5e96..03dde85632 100644
--- a/detections/endpoint/excessive_usage_of_taskkill.yml
+++ b/detections/endpoint/excessive_usage_of_taskkill.yml
@@ -26,6 +26,7 @@ tags:
   analytic_story:
   - XMRig
   - Azorult
+  - CISA AA22-264A
   confidence: 70
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
index 93d17df1aa..9058357029 100644
--- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -28,7 +28,8 @@ known_false_positives: False positives are possible with native utilities and th
   party applications. Filtering may be needed based on command-line, or add world
   writeable paths to restrict query.
 references:
-- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
+  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
+  - https://twitter.com/M_haggis/status/1491109262428635136
 tags:
   analytic_story:
   - Unusual Processes
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
index 80c3811294..15f5bc6bc3 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
@@ -39,6 +39,7 @@ tags:
   - Ransomware
   - Clop Ransomware
   - Insider Threat
+  - CISA AA22-264A
   cis20:
   - CIS 8
   - CIS 13
diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml
index 76f464f205..ff9aa9a798 100644
--- a/detections/endpoint/w3wp_spawning_shell.yml
+++ b/detections/endpoint/w3wp_spawning_shell.yml
@@ -39,6 +39,7 @@ tags:
   - HAFNIUM Group
   - ProxyShell
   - CISA AA22-257A
+  - CISA AA22-264A
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml
index 798cd03532..34843809db 100644
--- a/detections/endpoint/windows_disableantispyware_reg.yml
+++ b/detections/endpoint/windows_disableantispyware_reg.yml
@@ -32,6 +32,7 @@ tags:
   - Windows Defense Evasion Tactics
   - Windows Registry Abuse
   - Azorult
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 8
diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml
index 166f700a6f..a1dc1fe9f6 100644
--- a/detections/endpoint/windows_event_log_cleared.yml
+++ b/detections/endpoint/windows_event_log_cleared.yml
@@ -28,6 +28,7 @@ tags:
   - Windows Log Manipulation
   - Ransomware
   - Clop Ransomware
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml
index d0bc444de2..e25d72bb86 100644
--- a/detections/endpoint/windows_possible_credential_dumping.yml
+++ b/detections/endpoint/windows_possible_credential_dumping.yml
@@ -45,6 +45,7 @@ tags:
   - Detect Zerologon Attack
   - DarkSide Ransomware
   - CISA AA22-257A
+  - CISA AA22-264A
   automated_detection_testing: passed
   confidence: 80
   context:
diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
index 6afbb6c2d8..13340d30d9 100644
--- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
+++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
@@ -29,6 +29,7 @@ tags:
   - Caddy Wiper
   - Data Destruction
   - Hermetic Wiper
+  - CISA AA22-264A
   cis20:
   - CIS 3
   - CIS 5
diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
index 02a0890fa9..7f95b65390 100644
--- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
+++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
@@ -32,6 +32,7 @@ tags:
   - Caddy Wiper
   - WhisperGate
   - Hermetic Wiper
+  - CISA AA22-264A
   cis20:
   - CIS 3
   - CIS 5
diff --git a/detections/endpoint/windows_system_file_on_disk.yml b/detections/endpoint/windows_system_file_on_disk.yml
index b6684439c0..b8352c847b 100644
--- a/detections/endpoint/windows_system_file_on_disk.yml
+++ b/detections/endpoint/windows_system_file_on_disk.yml
@@ -21,6 +21,7 @@ references:
 tags:
   analytic_story:
   - Windows Drivers
+  - CISA AA22-264A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/experimental/endpoint/exchange_powershell_module_usage.yml b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
index 172e39c8e4..9cee336fb3 100644
--- a/detections/experimental/endpoint/exchange_powershell_module_usage.yml
+++ b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
@@ -1,8 +1,8 @@
 name: Exchange PowerShell Module Usage
 id: 2d10095e-05ae-11ec-8fdf-acde48001122
-version: 2
-date: '2022-05-02'
-author: Michael Haag
+version: 3
+date: '2022-09-22'
+author: Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: 'The following analytic identifies the usage of Exchange PowerShell modules
@@ -18,8 +18,11 @@ description: 'The following analytic identifies the usage of Exchange PowerShell
 
   Module - New-managementroleassignment can assign a management role to a management
   role group, management role assignment policy, user, or universal security group
-  (USG).'
-search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*")
+  (USG). \
+  
+  Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \
+  Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).'
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*", "*New-MailboxSearch*", "*Get-Recipient*")
   | stats count min(_time) as firstTime max(_time) as lastTime by lastTime by Opcode Computer
   UserID EventCode ScriptBlockText| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `exchange_powershell_module_usage_filter`'
@@ -29,14 +32,18 @@ how_to_implement: To successfully implement this analytic, you will need to enab
 known_false_positives: Administrators or power users may use this PowerShell commandlet
   for troubleshooting.
 references:
-- https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
-- https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
-- https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
-- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
-- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
+  - https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
+  - https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
+  - https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
+  - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+  - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
+  - https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
+  - https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps
+  - https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps
 tags:
   analytic_story:
   - ProxyShell
+  - CISA AA22-264A
   asset_type: Endpoint
   confidence: 50
   context:
diff --git a/lookups/attacker_tools.csv b/lookups/attacker_tools.csv
index 38d33513d5..834f72dd09 100644
--- a/lookups/attacker_tools.csv
+++ b/lookups/attacker_tools.csv
@@ -25,3 +25,4 @@ NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Au
 ns.exe,A commonly used tool used by attackers to scan and map file shares
 SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
 kportscan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking Forums to perform network scanning on the internal networks.
+advanced_port_scanner.exe, Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports.
\ No newline at end of file
diff --git a/stories/cisa_aa22_264a.yml b/stories/cisa_aa22_264a.yml
new file mode 100644
index 0000000000..ef2de00aed
--- /dev/null
+++ b/stories/cisa_aa22_264a.yml
@@ -0,0 +1,28 @@
+name: CISA AA22-264A
+id: bc7056a5-c3b0-4b83-93ce-5f31739305c8
+version: 1
+date: '2022-09-22'
+author: Michael Haag, Splunk
+description: Iranian State Actors Conduct Cyber Operations Against the Government of Albania.
+narrative: In July 2022, Iranian state cyber actors—identifying as “HomeLand Justice”—launched a destructive cyber attack against the Government of Albania which rendered websites and services unavailable. A FBI investigation indicates Iranian state cyber actors acquired initial access to the victim’s network approximately 14 months before launching the destructive cyber attack, which included a ransomware-style file encryptor and disk wiping malware. The actors maintained continuous network access for approximately a year, periodically accessing and exfiltrating e-mail content.
+
+Between May and June 2022, Iranian state cyber actors conducted lateral movements, network reconnaissance, and credential harvesting from Albanian government networks. In July 2022, the actors launched ransomware on the networks, leaving an anti-Mujahideen E-Khalq (MEK) message on desktops. When network defenders identified and began to respond to the ransomware activity, the cyber actors deployed a version of ZeroCleare destructive malware.
+
+In June 2022, HomeLand Justice created a website and multiple social media profiles posting anti-MEK messages. On July 18, 2022, HomeLand Justice claimed credit for the cyber attack on Albanian government infrastructure. On July 23, 2022, Homeland Justice posted videos of the cyber attack on their website. From late July to mid-August 2022, social media accounts associated with HomeLand Justice demonstrated a repeated pattern of advertising Albanian Government information for release, posting a poll asking respondents to select the government information to be released by HomeLand Justice, and then releasing that information—either in a .zip file or a video of a screen recording with the documents shown.
+
+In September 2022, Iranian cyber actors launched another wave of cyber attacks against the Government of Albania, using similar TTPs and malware as the cyber attacks in July. These were likely done in retaliation for public attribution of the cyber attacks in July and severed diplomatic ties between Albania and Iran.
+(ref. CISA Alert)
+references:
+  - https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
+  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-264a-iranian-cyber-actors-conduct-cyber-operations-against-the-government-of-albania.pdf
+  - https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against 
+  - https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/ 
+tags:
+  analytic_story: CISA AA22-264A
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

From 94787c626fd32d5fba3cf4e55e2d1df5e5cd30d0 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 26 Sep 2022 13:00:17 -0600
Subject: [PATCH 02/13] New content

---
 ..._hijacking_inprocserver32_modification.yml | 64 ++++++++++++++
 ..._hijacking_inprocserver32_modification.yml | 72 ++++++++++++++++
 ...oxy_execution_syncappvpublishingserver.yml | 83 +++++++++++++++++++
 ...cking_inprocserver32_modification.test.yml | 14 ++++
 ...cking_inprocserver32_modification.test.yml | 13 +++
 ...xecution_syncappvpublishingserver.test.yml | 13 +++
 6 files changed, 259 insertions(+)
 create mode 100644 detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml
 create mode 100644 detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
 create mode 100644 detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml
 create mode 100644 tests/endpoint/powershell_com_hijacking_inprocserver32_modification.test.yml
 create mode 100644 tests/endpoint/windows_com_hijacking_inprocserver32_modification.test.yml
 create mode 100644 tests/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.test.yml

diff --git a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml
new file mode 100644
index 0000000000..8d0a646b69
--- /dev/null
+++ b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml
@@ -0,0 +1,64 @@
+name: Powershell COM Hijacking InprocServer32 Modification
+id: ea61e291-af05-4716-932a-67faddb6ae6f
+version: 1
+date: '2022-09-26'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell ScriptBlock Logging to identify a script that is attempting to modify or add a component object model to inprocserver32 path within the registry.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Software\\Classes\\CLSID\\*\\InProcServer32*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `powershell_com_hijacking_inprocserver32_modification_filter`'
+how_to_implement: The following analytic requires PowerShell operational logs
+  to be imported. Modify the PowerShell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: False positives will be present if any scripts are adding to inprocserver32. Filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1546/015/
+  - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
+  - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-powershell.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  - Installation
+  message: A PowerShell script has been identified with InProcServer32 within the script code on $Computer$.
+  mitre_attack_id:
+  - T1546.015
+  - T1059
+  - T1059.001
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
+  - EventCode
+  risk_score: 64
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
new file mode 100644
index 0000000000..abb0f714ff
--- /dev/null
+++ b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
@@ -0,0 +1,72 @@
+name: Windows COM Hijacking InprocServer32 Modification
+id: b7bd83c0-92b5-4fc7-b286-23eccfa2c561
+version: 1
+date: '2022-09-26'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of reg.exe performing an add to the InProcServer32, which is related to COM hijacking.
+  Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_reg`
+  Processes.process=*inprocserver32* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_com_hijacking_inprocserver32_modification_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present and some filtering may be required.
+references:
+  - https://attack.mitre.org/techniques/T1546/015/
+  - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to modify InProcServer32 within the registry.
+  mitre_attack_id:
+  - T1546.015
+  - T1546
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - UPDATE
+  risk_score: 64
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml
new file mode 100644
index 0000000000..eb6677ab7a
--- /dev/null
+++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml
@@ -0,0 +1,83 @@
+name: Windows System Script Proxy Execution Syncappvpublishingserver
+id: 8dd73f89-682d-444c-8b41-8e679966ad3c
+version: 1
+date: '2022-09-26'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the abuse of Syncappvpublishingserver.vbs, which is a native script on Windows that may be utilized to download remote files or perform privilege escalation.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("wscript.exe","cscript.exe")
+  Processes.process="*syncappvpublishingserver.vbs*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_system_script_proxy_execution_syncappvpublishingserver_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present if the vbscript syncappvpublishingserver is used for legitimate purposes. Filter as needed. Adding a n; to the command-line arguments may help reduce any noise.
+references:
+  - https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1216/T1216.md#atomic-test-1---syncappvpublishingserver-signed-script-powershell-command-execution
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download files or evade critical controls.
+  mitre_attack_id:
+  - T1216
+  - T1218
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 30
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
\ No newline at end of file
diff --git a/tests/endpoint/powershell_com_hijacking_inprocserver32_modification.test.yml b/tests/endpoint/powershell_com_hijacking_inprocserver32_modification.test.yml
new file mode 100644
index 0000000000..a00c7a6792
--- /dev/null
+++ b/tests/endpoint/powershell_com_hijacking_inprocserver32_modification.test.yml
@@ -0,0 +1,14 @@
+name: Powershell COM Hijacking InprocServer32 Modification Unit
+  Test
+tests:
+- name: Powershell COM Hijacking InprocServer32 Modification
+  file: endpoint/powershell_com_hijacking_inprocserver32_modification.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_com_hijacking_inprocserver32_modification.test.yml b/tests/endpoint/windows_com_hijacking_inprocserver32_modification.test.yml
new file mode 100644
index 0000000000..99f7fa7785
--- /dev/null
+++ b/tests/endpoint/windows_com_hijacking_inprocserver32_modification.test.yml
@@ -0,0 +1,13 @@
+name: Windows COM Hijacking InprocServer32 Modification Unit Test
+tests:
+- name: Windows COM Hijacking InprocServer32 Modification
+  file: endpoint/windows_com_hijacking_inprocserver32_modification.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.test.yml b/tests/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.test.yml
new file mode 100644
index 0000000000..1892cb134a
--- /dev/null
+++ b/tests/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.test.yml
@@ -0,0 +1,13 @@
+name: Windows System Script Proxy Execution Syncappvpublishingserver Unit Test
+tests:
+- name: Windows System Script Proxy Execution Syncappvpublishingserver
+  file: endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 880691a7c9503a6bc413827faadfc6619370662a Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 26 Sep 2022 14:30:26 -0600
Subject: [PATCH 03/13] Update cisa_aa22_264a.yml

---
 stories/cisa_aa22_264a.yml | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/stories/cisa_aa22_264a.yml b/stories/cisa_aa22_264a.yml
index ef2de00aed..c49555d358 100644
--- a/stories/cisa_aa22_264a.yml
+++ b/stories/cisa_aa22_264a.yml
@@ -4,14 +4,8 @@ version: 1
 date: '2022-09-22'
 author: Michael Haag, Splunk
 description: Iranian State Actors Conduct Cyber Operations Against the Government of Albania.
-narrative: In July 2022, Iranian state cyber actors—identifying as “HomeLand Justice”—launched a destructive cyber attack against the Government of Albania which rendered websites and services unavailable. A FBI investigation indicates Iranian state cyber actors acquired initial access to the victim’s network approximately 14 months before launching the destructive cyber attack, which included a ransomware-style file encryptor and disk wiping malware. The actors maintained continuous network access for approximately a year, periodically accessing and exfiltrating e-mail content.
+narrative: The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory to provide information on recent cyber operations against the Government of Albania in July and September. This advisory provides a timeline of activity observed, from initial access to execution of encryption and wiper attacks. Additional information concerning files used by the actors during their exploitation of and cyber attack against the victim organization is provided in Appendices A and B. In September 2022, Iranian cyber actors launched another wave of cyber attacks against the Government of Albania, using similar TTPs and malware as the cyber attacks in July. These were likely done in retaliation for public attribution of the cyber attacks in July and severed diplomatic ties between Albania and Iran.
 
-Between May and June 2022, Iranian state cyber actors conducted lateral movements, network reconnaissance, and credential harvesting from Albanian government networks. In July 2022, the actors launched ransomware on the networks, leaving an anti-Mujahideen E-Khalq (MEK) message on desktops. When network defenders identified and began to respond to the ransomware activity, the cyber actors deployed a version of ZeroCleare destructive malware.
-
-In June 2022, HomeLand Justice created a website and multiple social media profiles posting anti-MEK messages. On July 18, 2022, HomeLand Justice claimed credit for the cyber attack on Albanian government infrastructure. On July 23, 2022, Homeland Justice posted videos of the cyber attack on their website. From late July to mid-August 2022, social media accounts associated with HomeLand Justice demonstrated a repeated pattern of advertising Albanian Government information for release, posting a poll asking respondents to select the government information to be released by HomeLand Justice, and then releasing that information—either in a .zip file or a video of a screen recording with the documents shown.
-
-In September 2022, Iranian cyber actors launched another wave of cyber attacks against the Government of Albania, using similar TTPs and malware as the cyber attacks in July. These were likely done in retaliation for public attribution of the cyber attacks in July and severed diplomatic ties between Albania and Iran.
-(ref. CISA Alert)
 references:
   - https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
   - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-264a-iranian-cyber-actors-conduct-cyber-operations-against-the-government-of-albania.pdf

From 63f679f2fce3fae023c6c84bca557c56c65a48c6 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 27 Sep 2022 08:00:34 -0600
Subject: [PATCH 04/13] Office Product Spawning Windows Script Host

---
 ...e_product_spawning_windows_script_host.yml | 68 +++++++++++++++++++
 ...duct_spawning_windows_script_host.test.yml | 13 ++++
 2 files changed, 81 insertions(+)
 create mode 100644 detections/endpoint/office_product_spawning_windows_script_host.yml
 create mode 100644 tests/endpoint/office_product_spawning_windows_script_host.test.yml

diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml
new file mode 100644
index 0000000000..107facf671
--- /dev/null
+++ b/detections/endpoint/office_product_spawning_windows_script_host.yml
@@ -0,0 +1,68 @@
+name: Office Product Spawning Windows Script Host
+id: b3628a5b-8d02-42fa-a891-eebf2351cbe1
+version: 1
+date: '2022-09-26'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic will identify a Windows Office Product spawning WScript or CScript. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name IN ("wscript.exe", "cscript.exe")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `office_product_spawning_windows_script_host_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present based on macro based approved documents in the organization. Filtering may be needed.
+references:
+  - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: office parent process $parent_process_name$ will execute a suspicious child
+    process $process_name$ on host $dest$.
+  mitre_attack_id:
+  - T1566
+  - T1566.001
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 63
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  asset_type: Endpoint
diff --git a/tests/endpoint/office_product_spawning_windows_script_host.test.yml b/tests/endpoint/office_product_spawning_windows_script_host.test.yml
new file mode 100644
index 0000000000..df1423f076
--- /dev/null
+++ b/tests/endpoint/office_product_spawning_windows_script_host.test.yml
@@ -0,0 +1,13 @@
+name: Office Product Spawning Windows Script Host Unit Test
+tests:
+- name: Office Product Spawning Windows Script Host
+  file: endpoint/office_product_spawning_windows_script_host.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

From a1880f5770859446e2f30f89fee4e1f7c88cfc5b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 27 Sep 2022 09:55:53 -0600
Subject: [PATCH 05/13] data fix

---
 .../office_product_spawning_windows_script_host.yml       | 2 +-
 .../office_product_spawning_windows_script_host.test.yml  | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml
index 107facf671..9905c7081f 100644
--- a/detections/endpoint/office_product_spawning_windows_script_host.yml
+++ b/detections/endpoint/office_product_spawning_windows_script_host.yml
@@ -26,7 +26,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log
   impact: 70
   kill_chain_phases:
   - Exploitation
diff --git a/tests/endpoint/office_product_spawning_windows_script_host.test.yml b/tests/endpoint/office_product_spawning_windows_script_host.test.yml
index df1423f076..f3f953259e 100644
--- a/tests/endpoint/office_product_spawning_windows_script_host.test.yml
+++ b/tests/endpoint/office_product_spawning_windows_script_host.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
-    source: XmlWinEventLog:Security
-    sourcetype: XmlWinEventLog
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
     update_timestamp: true

From 3a1f0aadc7d9f8abdb2fcc2d2e446063394c776b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 27 Sep 2022 14:52:26 -0600
Subject: [PATCH 06/13] Okta

---
 ...h_invalid_credentials_from_the_same_ip.yml | 37 ++++++-----
 .../application/okta_account_locked_out.yml   | 52 +++++++++++++++
 .../okta_account_lockout_events.yml           | 29 +++++----
 .../application/okta_failed_sso_attempts.yml  | 27 ++++----
 .../application/okta_mfa_exhaustion_hunt.yml  | 63 +++++++++++++++++++
 .../okta_new_api_token_created.yml            | 59 +++++++++++++++++
 .../okta_new_device_enrolled_on_account.yml   | 55 ++++++++++++++++
 .../okta_suspicious_activity_reported.yml     | 55 ++++++++++++++++
 .../okta_threatinsight_threat_detected.yml    | 60 ++++++++++++++++++
 .../okta_two_or_more_rejected_okta_pushes.yml | 56 +++++++++++++++++
 stories/okta_mfa_exhaustion.yml               | 20 ++++++
 11 files changed, 472 insertions(+), 41 deletions(-)
 create mode 100644 detections/experimental/application/okta_account_locked_out.yml
 create mode 100644 detections/experimental/application/okta_mfa_exhaustion_hunt.yml
 create mode 100644 detections/experimental/application/okta_new_api_token_created.yml
 create mode 100644 detections/experimental/application/okta_new_device_enrolled_on_account.yml
 create mode 100644 detections/experimental/application/okta_suspicious_activity_reported.yml
 create mode 100644 detections/experimental/application/okta_threatinsight_threat_detected.yml
 create mode 100644 detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
 create mode 100644 stories/okta_mfa_exhaustion.yml

diff --git a/detections/experimental/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml b/detections/experimental/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml
index c879649f3e..e0bea1863a 100644
--- a/detections/experimental/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml
+++ b/detections/experimental/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml
@@ -1,25 +1,28 @@
 name: Multiple Okta Users With Invalid Credentials From The Same IP
 id: 19cba45f-cad3-4032-8911-0c09e0444552
-version: 2
-date: '2020-07-21'
-author: Rico Valdez, Splunk
-type: TTP
+version: 3
+date: '2022-09-21'
+author: Michael Haag, Rico Valdez, Splunk
+type: Hunting
 datamodel: []
-description: This search detects Okta login failures due to bad credentials for multiple
-  users originating from the same ip address.
-search: '`okta` outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country
+description: This hunting analytic identifies multiple failed logon attempts from a single IP. Use this analytic to identify patterns of suspicious logins from a single source and filter as needed or use this to drive tuning for higher fidelity analytics.
+search: '`okta` outcome.reason=INVALID_CREDENTIALS 
+  | rename client.geographicalContext.country
   as country, client.geographicalContext.state as state, client.geographicalContext.city
-  as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users
-  values(user) as users by src_ip, displayMessage, outcome.reason, country, state,
-  city  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  |  search distinct_users > 5| `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` '
+  as city 
+  | stats min(_time) as firstTime max(_time) as lastTime dc(src_user) as distinct_users
+  values(src_user) as users by src_ip, displayMessage, outcome.reason, country, state,
+  city 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | search distinct_users > 5| `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` '
 how_to_implement: This search is specific to Okta and requires Okta logs are being
   ingested in your Splunk deployment.
 known_false_positives: A single public IP address servicing multiple legitmate users
   may trigger this search. In addition, the threshold of 5 distinct users may be too
   low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter`
   to raise the threshold or except specific IP adresses from triggering this search.
-references: []
+references:
+  - https://developer.okta.com/docs/reference/api/event-types/?q=INVALID_CREDENTIALS
 tags:
   analytic_story:
   - Suspicious Okta Activity
@@ -45,13 +48,13 @@ tags:
   - src_ip
   - displayMessage
   security_domain: access
-  confidence: 50
-  impact: 50
-  risk_score: 25
+  confidence: 30
+  impact: 30
+  risk_score: 9
   context: []
-  message: tbd
+  message: Multple user accounts have failed to authenticate from a single IP.
   observable:
-  - name: user
+  - name: src_user
     type: User
     role:
     - Victim
diff --git a/detections/experimental/application/okta_account_locked_out.yml b/detections/experimental/application/okta_account_locked_out.yml
new file mode 100644
index 0000000000..c3cdd77d34
--- /dev/null
+++ b/detections/experimental/application/okta_account_locked_out.yml
@@ -0,0 +1,52 @@
+name: Okta Account Locked Out
+id: d650c0ae-bdc5-400e-9f0f-f7aa0a010ef1
+version: 1
+date: '2022-09-21'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic utilizes the user.acount.lock event to identify associates who are locked out of Okta. An adversary, attempting to brute force or password spray account names, may lock accounts out depending on the threshold. 
+search: '`okta` eventType=user.account.lock
+  | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by src_user src_ip eventType status
+  | where count >=3
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `okta_account_locked_out_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta logs to be
+  ingested.
+known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed. Drop to anomaly until tuning is complete.
+references:
+  - https://developer.okta.com/docs/reference/api/event-types/?q=user.acount.lock
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  - Okta MFA Exhaustion
+  asset_type: Infrastructure
+  cis20:
+  - CIS 16
+  mitre_attack_id:
+  - T1110
+  nist:
+  - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - src_user 
+  - src_ip 
+  - eventType 
+  - status
+  security_domain: access
+  confidence: 80
+  impact: 80
+  risk_score: 64
+  context: []
+  message: $src_user$ account has been locked out.
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Attacker
+  kill_chain_phases:
+  - Exploitation
diff --git a/detections/experimental/application/okta_account_lockout_events.yml b/detections/experimental/application/okta_account_lockout_events.yml
index 0a42a1e4f1..80664492d4 100644
--- a/detections/experimental/application/okta_account_lockout_events.yml
+++ b/detections/experimental/application/okta_account_lockout_events.yml
@@ -1,20 +1,25 @@
 name: Okta Account Lockout Events
 id: 62b70968-a0a5-4724-8ac4-67871e6f544d
 version: 2
-date: '2020-07-21'
-author: Rico Valdez, Splunk
+date: '2022-09-19'
+author: Michael Haag, Rico Valdez, Splunk
 type: Anomaly
 datamodel: []
-description: Detect Okta user lockout events
-search: '`okta` displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country
-  as country, client.geographicalContext.state as state, client.geographicalContext.city
-  as city | table _time, user, country, state, city, src_ip | `okta_account_lockout_events_filter` '
-how_to_implement: This search is specific to Okta and requires Okta logs are being
-  ingested in your Splunk deployment.
+description: The following anomaly will generate based on account lockout events utilizing Okta eventTypes of user.account.lock.limit or user.account.lock. Per the Okta docs site, this event is fired when a user account has reached the lockout limit. The account will not auto-unlock and a user or client cannot gain access to the account. This event indicates an account that will not be able to log in until remedial action is taken by the account admin. This event can be used to understand the specifics of an account lockout. Often this indicates a client application that is repeatedly attempting to authenticate with invalid credentials such as an old password.
+search: '`okta` eventType IN (user.account.lock.limit,user.account.lock)
+  | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city
+  | stats count min(_time) as firstTime max(_time) as lastTime values(src_user) by displayMessage, country, state, city, src_ip
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `okta_account_lockout_events_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta logs to be
+  ingested.
 known_false_positives: None. Account lockouts should be followed up on to determine
   if the actual user was the one who caused the lockout, or if it was an unauthorized
   actor.
-references: []
+references:
+  - https://developer.okta.com/docs/reference/api/event-types/#catalog
+  - https://developer.okta.com/docs/reference/api/event-types/?q=user.account.lock
 tags:
   analytic_story:
   - Suspicious Okta Activity
@@ -36,14 +41,16 @@ tags:
   - client.geographicalContext.country
   - client.geographicalContext.state
   - client.geographicalContext.city
+  - src_ip
+  - src_user
   security_domain: access
   confidence: 50
   impact: 50
   risk_score: 25
   context: []
-  message: tbd
+  message: The following user $src_user$ has locked out their account within Okta.
   observable:
-  - name: user
+  - name: src_user
     type: User
     role:
     - Victim
diff --git a/detections/experimental/application/okta_failed_sso_attempts.yml b/detections/experimental/application/okta_failed_sso_attempts.yml
index b3254a1d38..3539428e6b 100644
--- a/detections/experimental/application/okta_failed_sso_attempts.yml
+++ b/detections/experimental/application/okta_failed_sso_attempts.yml
@@ -1,20 +1,21 @@
 name: Okta Failed SSO Attempts
 id: 371a6545-2618-4032-ad84-93386b8698c5
-version: 2
-date: '2020-07-21'
-author: Rico Valdez, Splunk
+version: 3
+date: '2022-09-21'
+author: Michael Haag, Rico Valdez, Splunk
 type: Anomaly
 datamodel: []
-description: Detect failed Okta SSO events
-search: '`okta` displayMessage="User attempted unauthorized access to app" | stats  min(_time)
-  as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage,
+description: The following anomaly identifies failed Okta SSO events utilizing the legacy Okta event "unauth app access attempt". 
+search: '`okta` eventType=app.generic.unauth_app_access_attempt | stats min(_time)
+  as firstTime max(_time) as lastTime values(app) as Apps count by src_user, result ,displayMessage,
   src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `okta_failed_sso_attempts_filter` '
 how_to_implement: This search is specific to Okta and requires Okta logs are being
   ingested in your Splunk deployment.
 known_false_positives: There may be a faulty config preventing legitmate users from
   accessing apps they should have access to.
-references: []
+references:
+  - https://developer.okta.com/docs/reference/api/event-types/?q=app.generic.unauth_app_access_attempt
 tags:
   analytic_story:
   - Suspicious Okta Activity
@@ -34,17 +35,17 @@ tags:
   - _time
   - displayMessage
   - app
-  - user
+  - src_user
   - result
   - src_ip
   security_domain: access
-  confidence: 50
-  impact: 50
-  risk_score: 25
+  confidence: 40
+  impact: 40
+  risk_score: 16
   context: []
-  message: tbd
+  message: $src_user$ failed SSO authentication to the app.
   observable:
-  - name: user
+  - name: src_user
     type: User
     role:
     - Victim
diff --git a/detections/experimental/application/okta_mfa_exhaustion_hunt.yml b/detections/experimental/application/okta_mfa_exhaustion_hunt.yml
new file mode 100644
index 0000000000..979f462f57
--- /dev/null
+++ b/detections/experimental/application/okta_mfa_exhaustion_hunt.yml
@@ -0,0 +1,63 @@
+name: Okta MFA Exhaustion Hunt
+id: 97e2fe57-3740-402c-988a-76b64ce04b8d
+version: 1
+date: '2022-09-27'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: The following analytic identifies patterns within Okta data to determine the amount of successful and failed pushes. Based on that, eval statements determine a finding of whether this is suspicious or not. The events are within a window of time and may be tuned as needed.
+search: '`okta`
+  eventType=system.push.send_factor_verify_push OR ((legacyEventType=core.user.factor.attempt_success) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH)) OR ((legacyEventType=core.user.factor.attempt_fail) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH))
+  | stats count(eval(legacyEventType="core.user.factor.attempt_success")) as successes count(eval(legacyEventType="core.user.factor.attempt_fail")) as failures count(eval(eventType="system.push.send_factor_verify_push")) as pushes by authenticationContext.externalSessionId,user,_time
+  | stats latest(_time) as lasttime earliest(_time) as firsttime sum(successes) as successes sum(failures) as failures sum(pushes) as pushes by authenticationContext.externalSessionId,user
+  | eval seconds=lasttime-firsttime
+  | eval lasttime=strftime(lasttime, "%c")
+  | search (pushes>1)
+  | eval totalattempts=successes+failures
+  | eval finding="Normal authentication pattern"
+  | eval finding=if(failures==pushes AND pushes>1,"Authentication attempts not successful because multiple pushes denied",finding)
+  | eval finding=if(totalattempts==0,"Multiple pushes sent and ignored",finding)
+  | eval finding=if(successes>0 AND pushes>3,"Probably should investigate. Multiple pushes sent, eventual successful authentication!",finding)
+  | where seconds<600 AND finding="Multiple pushes sent, eventual successful authentication!" AND totalattempts > 5
+  | sort - pushes, totalattempts 
+  | `okta_mfa_exhaustion_hunt_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta logs to be
+  ingested.
+known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed. Drop to anomaly until tuning is complete.
+references:
+  - https://developer.okta.com/docs/reference/api/event-types/?q=user.acount.lock
+  - https://sec.okta.com/everythingisyes
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  - Okta MFA Exhaustion
+  asset_type: Infrastructure
+  cis20:
+  - CIS 16
+  mitre_attack_id:
+  - T1110
+  nist:
+  - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - src_user 
+  - src_ip 
+  - eventType 
+  - status
+  security_domain: access
+  confidence: 60
+  impact: 30
+  risk_score: 18
+  context: []
+  message: $src_user$ account has rejected multiple Okta pushes.
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Attacker
+  kill_chain_phases:
+  - Exploitation
diff --git a/detections/experimental/application/okta_new_api_token_created.yml b/detections/experimental/application/okta_new_api_token_created.yml
new file mode 100644
index 0000000000..7bdbbd1d28
--- /dev/null
+++ b/detections/experimental/application/okta_new_api_token_created.yml
@@ -0,0 +1,59 @@
+name: Okta New API Token Created
+id: c3d22720-35d3-4da4-bd0a-740d37192bd4
+version: 1
+date: '2022-09-21'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies when a new API token is created. Adversaries who have gained access to a privileged account may add a new token for persistence. This analytic uses the eventType system.api_token.create.
+search: '`okta` eventType=system.api_token.create
+| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by src_user src_ip eventType status
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `okta_new_api_token_created_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta logs to be
+  ingested.
+known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed.
+references:
+  - https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  cis20:
+  - CIS 16
+  mitre_attack_id:
+  - T1078
+  - T1078.001
+  nist:
+  - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - signature 
+  - eventType 
+  - displayMessage
+  - client.device 
+  - city
+  - state
+  - country
+  - user_agent
+  - outcome.reason
+  - outcome.result 
+  - severity 
+  security_domain: access
+  confidence: 50
+  impact: 80
+  risk_score: 40
+  context: []
+  message: $src_user$ has created a new API token within Okta.
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Attacker
+  kill_chain_phases:
+  - Exploitation
diff --git a/detections/experimental/application/okta_new_device_enrolled_on_account.yml b/detections/experimental/application/okta_new_device_enrolled_on_account.yml
new file mode 100644
index 0000000000..4bc92cb62c
--- /dev/null
+++ b/detections/experimental/application/okta_new_device_enrolled_on_account.yml
@@ -0,0 +1,55 @@
+name: Okta New Device Enrolled on Account
+id: bb27cbce-d4de-432c-932f-2e206e9130fb
+version: 1
+date: '2022-09-21'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following anomaly will be generated when a new device is added to an account. Albeit not malicious, risk is set low, but should be monitored. This anomaly utilizes the legacy events from Okta.
+search: '`okta` eventType=system.email.new_device_notification.sent_message
+displayMessage="Send user new device notification email"
+  | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser client.geographicalContext.city client.geographicalContext.country
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `okta_new_device_enrolled_on_account_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta logs to be
+  ingested.
+known_false_positives: Tune the risk score as needed based on your organization.
+references:
+  - https://developer.okta.com/docs/reference/api/event-types/?q=system.email.new_device_notification.sent_message
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  cis20:
+  - CIS 16
+  mitre_attack_id:
+  - T1078
+  - T1078.001
+  nist:
+  - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - displayMessage
+  - user
+  - eventType
+  - client.userAgent.rawUserAgent 
+  - client.userAgent.browser 
+  - client.geographicalContext.city 
+  - client.geographicalContext.country
+  security_domain: access
+  confidence: 60
+  impact: 40
+  risk_score: 24
+  context: []
+  message: $user$ has added a new device to their account.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  kill_chain_phases:
+  - Exploitation
diff --git a/detections/experimental/application/okta_suspicious_activity_reported.yml b/detections/experimental/application/okta_suspicious_activity_reported.yml
new file mode 100644
index 0000000000..4556d935fa
--- /dev/null
+++ b/detections/experimental/application/okta_suspicious_activity_reported.yml
@@ -0,0 +1,55 @@
+name: Okta Suspicious Activity Reported
+id: bfc840f5-c9c6-454c-aa13-b46fd0bf1e79
+version: 1
+date: '2022-09-21'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: The following event is generated when an associate receives an email from Okta asking if a login attempt was suspicious or not. If the associate identifies it as suspicious an event is generated and should be reviewed.
+search: '`okta` eventType=user.account.report_suspicious_activity_by_enduser 
+  | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser client.geographicalContext.city client.geographicalContext.country
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `okta_suspicious_activity_reported_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta logs to be
+  ingested. It also requires that suspicious activity reporting is enabled and associates are trained to submit.
+known_false_positives: False positives should be limited as this is a high fidelity marker.
+references:
+  - https://help.okta.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  cis20:
+  - CIS 16
+  mitre_attack_id:
+  - T1078
+  - T1078.001
+  nist:
+  - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - displayMessage
+  - user
+  - eventType
+  - client.userAgent.rawUserAgent 
+  - client.userAgent.browser 
+  - client.geographicalContext.city 
+  - client.geographicalContext.country
+  security_domain: access
+  confidence: 50
+  impact: 50
+  risk_score: 25
+  context: []
+  message: The following $user$ has reported a suspicious login activity.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  kill_chain_phases:
+  - Exploitation
diff --git a/detections/experimental/application/okta_threatinsight_threat_detected.yml b/detections/experimental/application/okta_threatinsight_threat_detected.yml
new file mode 100644
index 0000000000..8a57d66c36
--- /dev/null
+++ b/detections/experimental/application/okta_threatinsight_threat_detected.yml
@@ -0,0 +1,60 @@
+name: Okta ThreatInsight Threat Detected
+id: 140504ae-5fe2-4d65-b2bc-a211813fbca6
+version: 1
+date: '2022-09-21'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following anomaly relies on the Okta ThreatInsight identification of a threat. Use this to drive risk up by src_ip or add additional fields to track. Identification may include password spraying, login failures and Login failures with high unknown users count.
+search: '`okta` eventType IN (security.threat.detected, security.internal.threat.detected) 
+  | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city
+  | stats values(src_ip) count by signature eventType displayMessage client.device city state country user_agent outcome.reason outcome.result severity 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `okta_threatinsight_threat_detected_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta logs to be
+  ingested.
+known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed.
+references:
+  - https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  cis20:
+  - CIS 16
+  mitre_attack_id:
+  - T1078
+  - T1078.001
+  nist:
+  - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - signature 
+  - eventType 
+  - displayMessage
+  - client.device 
+  - city
+  - state
+  - country
+  - user_agent
+  - outcome.reason
+  - outcome.result 
+  - severity 
+  security_domain: access
+  confidence: 50
+  impact: 50
+  risk_score: 25
+  context: []
+  message: The following $src_ip$ has been conisidered a threat by Okta ThreatInsight.
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  kill_chain_phases:
+  - Exploitation
diff --git a/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml b/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
new file mode 100644
index 0000000000..99308d555b
--- /dev/null
+++ b/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
@@ -0,0 +1,56 @@
+name: Okta Two or More Rejected Okta Pushes
+id: d93f785e-4c2c-4262-b8c7-12b77a13fd39
+version: 1
+date: '2022-09-27'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an account that has rejected more than 2 Push notifications in a 10 minute window. 
+  Modify this query for your environment by upping the count or time window.
+search: '`okta` outcome.reason="User rejected Okta push verify" OR (debugContext.debugData.factor="OKTA_VERIFY_PUSH" outcome.result=FAILURE legacyEventType="core.user.factor.attempt_fail" "target{}.detailEntry.methodTypeUsed"="Get a push notification") 
+  | bin _time as bin_time span=10m 
+  | eval user=coalesce('actor.alternateId',user), user=mvindex(split(user, "@"), 0), event_time = _time 
+  | stats earliest(event_time) as event_time, min(_time) as firsttime max(_time) as lasttime values(client.ipAddress) as client.ipAddress, values(outcome.reason) as outcome, values(src_ip) AS src_ip, values(client.userAgent.rawUserAgent) as user_agent, values(eventType) as eventType, values(outcome.result) as action, values(legacyEventType) as legacyEventType values(index) as idx, values(sourcetype) as st count by bin_time user host 
+  | rename bin_time as timeWindow 
+  | convert ctime(*timeWindow) ctime(firsttime) ctime(lasttime) 
+  | where count >= 2
+  | `okta_two_or_more_rejected_okta_pushes_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta logs to be
+  ingested.
+known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed. Drop to anomaly until tuning is complete.
+references:
+  - https://developer.okta.com/docs/reference/api/event-types/?q=user.acount.lock
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  - Okta MFA Exhaustion
+  asset_type: Infrastructure
+  cis20:
+  - CIS 16
+  mitre_attack_id:
+  - T1110
+  nist:
+  - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - src_user 
+  - src_ip 
+  - eventType 
+  - status
+  security_domain: access
+  confidence: 80
+  impact: 80
+  risk_score: 64
+  context: []
+  message: $src_user$ account has rejected multiple Okta pushes.
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Attacker
+  kill_chain_phases:
+  - Exploitation
diff --git a/stories/okta_mfa_exhaustion.yml b/stories/okta_mfa_exhaustion.yml
new file mode 100644
index 0000000000..8a327e6b40
--- /dev/null
+++ b/stories/okta_mfa_exhaustion.yml
@@ -0,0 +1,20 @@
+name: Okta MFA Exhaustion
+id: 7c6e508d-4b4d-42c8-82de-5ff4ea3b0cb3
+version: 1
+date: '2022-09-27'
+author: Michael Haag, Splunk
+description: A social engineering technique called 'MFA Fatigue', aka 'MFA push spam' or 'MFA Exhaustion', is growing more popular with threat actors as it does not require malware or phishing infrastructure and has proven to be successful in attacks.
+narrative: An MFA Fatigue attack is when a threat actor runs a script that attempts to log in with stolen credentials over and over, causing what feels like an endless stream of MFA push requests to be sent to the account's owner's mobile device.
+  The goal is to keep this up, day and night, to break down the target's cybersecurity posture and inflict a sense of "fatigue" regarding these MFA prompts.
+references: 
+  - https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/
+  - https://www.csoonline.com/article/3674156/multi-factor-authentication-fatigue-attacks-are-on-the-rise-how-to-defend-against-them.html
+tags:
+  analytic_story: Okta MFA Exhaustion
+  category: 
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

From 7208e0198a1f2642c7a0991995caa9d8646be21f Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 27 Sep 2022 15:06:16 -0600
Subject: [PATCH 07/13] Update okta_two_or_more_rejected_okta_pushes.yml

---
 .../application/okta_two_or_more_rejected_okta_pushes.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml b/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
index 99308d555b..4c434480ad 100644
--- a/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
+++ b/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
@@ -9,7 +9,7 @@ description: The following analytic identifies an account that has rejected more
   Modify this query for your environment by upping the count or time window.
 search: '`okta` outcome.reason="User rejected Okta push verify" OR (debugContext.debugData.factor="OKTA_VERIFY_PUSH" outcome.result=FAILURE legacyEventType="core.user.factor.attempt_fail" "target{}.detailEntry.methodTypeUsed"="Get a push notification") 
   | bin _time as bin_time span=10m 
-  | eval user=coalesce('actor.alternateId',user), user=mvindex(split(user, "@"), 0), event_time = _time 
+  | eval user=coalesce("actor.alternateId",user), user=mvindex(split(user, "@"), 0), event_time = _time 
   | stats earliest(event_time) as event_time, min(_time) as firsttime max(_time) as lasttime values(client.ipAddress) as client.ipAddress, values(outcome.reason) as outcome, values(src_ip) AS src_ip, values(client.userAgent.rawUserAgent) as user_agent, values(eventType) as eventType, values(outcome.result) as action, values(legacyEventType) as legacyEventType values(index) as idx, values(sourcetype) as st count by bin_time user host 
   | rename bin_time as timeWindow 
   | convert ctime(*timeWindow) ctime(firsttime) ctime(lasttime) 

From ddcbfa65d0f4e9a5bb6e6fae8f702eda35e9c72b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 27 Sep 2022 15:15:11 -0600
Subject: [PATCH 08/13] Update okta_two_or_more_rejected_okta_pushes.yml

---
 .../application/okta_two_or_more_rejected_okta_pushes.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml b/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
index 4c434480ad..c0d6910f42 100644
--- a/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
+++ b/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
@@ -9,7 +9,7 @@ description: The following analytic identifies an account that has rejected more
   Modify this query for your environment by upping the count or time window.
 search: '`okta` outcome.reason="User rejected Okta push verify" OR (debugContext.debugData.factor="OKTA_VERIFY_PUSH" outcome.result=FAILURE legacyEventType="core.user.factor.attempt_fail" "target{}.detailEntry.methodTypeUsed"="Get a push notification") 
   | bin _time as bin_time span=10m 
-  | eval user=coalesce("actor.alternateId",user), user=mvindex(split(user, "@"), 0), event_time = _time 
+  | eval user=coalesce(actor.alternateId,user), user=mvindex(split(user, "@"), 0), event_time = _time 
   | stats earliest(event_time) as event_time, min(_time) as firsttime max(_time) as lasttime values(client.ipAddress) as client.ipAddress, values(outcome.reason) as outcome, values(src_ip) AS src_ip, values(client.userAgent.rawUserAgent) as user_agent, values(eventType) as eventType, values(outcome.result) as action, values(legacyEventType) as legacyEventType values(index) as idx, values(sourcetype) as st count by bin_time user host 
   | rename bin_time as timeWindow 
   | convert ctime(*timeWindow) ctime(firsttime) ctime(lasttime) 

From 24979489079bcfba51b96e5d79eb5c9536f12650 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 29 Sep 2022 11:47:58 -0600
Subject: [PATCH 09/13] removing okta

---
 .../application/okta_account_locked_out.yml   | 52 ---------------
 .../application/okta_mfa_exhaustion_hunt.yml  | 63 -------------------
 .../okta_new_api_token_created.yml            | 59 -----------------
 .../okta_new_device_enrolled_on_account.yml   | 55 ----------------
 .../okta_suspicious_activity_reported.yml     | 55 ----------------
 .../okta_threatinsight_threat_detected.yml    | 60 ------------------
 .../okta_two_or_more_rejected_okta_pushes.yml | 56 -----------------
 stories/okta_mfa_exhaustion.yml               | 20 ------
 8 files changed, 420 deletions(-)
 delete mode 100644 detections/experimental/application/okta_account_locked_out.yml
 delete mode 100644 detections/experimental/application/okta_mfa_exhaustion_hunt.yml
 delete mode 100644 detections/experimental/application/okta_new_api_token_created.yml
 delete mode 100644 detections/experimental/application/okta_new_device_enrolled_on_account.yml
 delete mode 100644 detections/experimental/application/okta_suspicious_activity_reported.yml
 delete mode 100644 detections/experimental/application/okta_threatinsight_threat_detected.yml
 delete mode 100644 detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
 delete mode 100644 stories/okta_mfa_exhaustion.yml

diff --git a/detections/experimental/application/okta_account_locked_out.yml b/detections/experimental/application/okta_account_locked_out.yml
deleted file mode 100644
index c3cdd77d34..0000000000
--- a/detections/experimental/application/okta_account_locked_out.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-name: Okta Account Locked Out
-id: d650c0ae-bdc5-400e-9f0f-f7aa0a010ef1
-version: 1
-date: '2022-09-21'
-author: Michael Haag, Splunk
-type: Anomaly
-datamodel: []
-description: The following analytic utilizes the user.acount.lock event to identify associates who are locked out of Okta. An adversary, attempting to brute force or password spray account names, may lock accounts out depending on the threshold. 
-search: '`okta` eventType=user.account.lock
-  | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by src_user src_ip eventType status
-  | where count >=3
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`| `okta_account_locked_out_filter`'
-how_to_implement: This analytic is specific to Okta and requires Okta logs to be
-  ingested.
-known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed. Drop to anomaly until tuning is complete.
-references:
-  - https://developer.okta.com/docs/reference/api/event-types/?q=user.acount.lock
-tags:
-  analytic_story:
-  - Suspicious Okta Activity
-  - Okta MFA Exhaustion
-  asset_type: Infrastructure
-  cis20:
-  - CIS 16
-  mitre_attack_id:
-  - T1110
-  nist:
-  - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - src_user 
-  - src_ip 
-  - eventType 
-  - status
-  security_domain: access
-  confidence: 80
-  impact: 80
-  risk_score: 64
-  context: []
-  message: $src_user$ account has been locked out.
-  observable:
-  - name: src_user
-    type: User
-    role:
-    - Attacker
-  kill_chain_phases:
-  - Exploitation
diff --git a/detections/experimental/application/okta_mfa_exhaustion_hunt.yml b/detections/experimental/application/okta_mfa_exhaustion_hunt.yml
deleted file mode 100644
index 979f462f57..0000000000
--- a/detections/experimental/application/okta_mfa_exhaustion_hunt.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-name: Okta MFA Exhaustion Hunt
-id: 97e2fe57-3740-402c-988a-76b64ce04b8d
-version: 1
-date: '2022-09-27'
-author: Michael Haag, Splunk
-type: Hunting
-datamodel: []
-description: The following analytic identifies patterns within Okta data to determine the amount of successful and failed pushes. Based on that, eval statements determine a finding of whether this is suspicious or not. The events are within a window of time and may be tuned as needed.
-search: '`okta`
-  eventType=system.push.send_factor_verify_push OR ((legacyEventType=core.user.factor.attempt_success) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH)) OR ((legacyEventType=core.user.factor.attempt_fail) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH))
-  | stats count(eval(legacyEventType="core.user.factor.attempt_success")) as successes count(eval(legacyEventType="core.user.factor.attempt_fail")) as failures count(eval(eventType="system.push.send_factor_verify_push")) as pushes by authenticationContext.externalSessionId,user,_time
-  | stats latest(_time) as lasttime earliest(_time) as firsttime sum(successes) as successes sum(failures) as failures sum(pushes) as pushes by authenticationContext.externalSessionId,user
-  | eval seconds=lasttime-firsttime
-  | eval lasttime=strftime(lasttime, "%c")
-  | search (pushes>1)
-  | eval totalattempts=successes+failures
-  | eval finding="Normal authentication pattern"
-  | eval finding=if(failures==pushes AND pushes>1,"Authentication attempts not successful because multiple pushes denied",finding)
-  | eval finding=if(totalattempts==0,"Multiple pushes sent and ignored",finding)
-  | eval finding=if(successes>0 AND pushes>3,"Probably should investigate. Multiple pushes sent, eventual successful authentication!",finding)
-  | where seconds<600 AND finding="Multiple pushes sent, eventual successful authentication!" AND totalattempts > 5
-  | sort - pushes, totalattempts 
-  | `okta_mfa_exhaustion_hunt_filter`'
-how_to_implement: This analytic is specific to Okta and requires Okta logs to be
-  ingested.
-known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed. Drop to anomaly until tuning is complete.
-references:
-  - https://developer.okta.com/docs/reference/api/event-types/?q=user.acount.lock
-  - https://sec.okta.com/everythingisyes
-tags:
-  analytic_story:
-  - Suspicious Okta Activity
-  - Okta MFA Exhaustion
-  asset_type: Infrastructure
-  cis20:
-  - CIS 16
-  mitre_attack_id:
-  - T1110
-  nist:
-  - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - src_user 
-  - src_ip 
-  - eventType 
-  - status
-  security_domain: access
-  confidence: 60
-  impact: 30
-  risk_score: 18
-  context: []
-  message: $src_user$ account has rejected multiple Okta pushes.
-  observable:
-  - name: src_user
-    type: User
-    role:
-    - Attacker
-  kill_chain_phases:
-  - Exploitation
diff --git a/detections/experimental/application/okta_new_api_token_created.yml b/detections/experimental/application/okta_new_api_token_created.yml
deleted file mode 100644
index 7bdbbd1d28..0000000000
--- a/detections/experimental/application/okta_new_api_token_created.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-name: Okta New API Token Created
-id: c3d22720-35d3-4da4-bd0a-740d37192bd4
-version: 1
-date: '2022-09-21'
-author: Michael Haag, Splunk
-type: TTP
-datamodel: []
-description: The following analytic identifies when a new API token is created. Adversaries who have gained access to a privileged account may add a new token for persistence. This analytic uses the eventType system.api_token.create.
-search: '`okta` eventType=system.api_token.create
-| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by src_user src_ip eventType status
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `okta_new_api_token_created_filter`'
-how_to_implement: This analytic is specific to Okta and requires Okta logs to be
-  ingested.
-known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed.
-references:
-  - https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected
-tags:
-  analytic_story:
-  - Suspicious Okta Activity
-  asset_type: Infrastructure
-  cis20:
-  - CIS 16
-  mitre_attack_id:
-  - T1078
-  - T1078.001
-  nist:
-  - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - signature 
-  - eventType 
-  - displayMessage
-  - client.device 
-  - city
-  - state
-  - country
-  - user_agent
-  - outcome.reason
-  - outcome.result 
-  - severity 
-  security_domain: access
-  confidence: 50
-  impact: 80
-  risk_score: 40
-  context: []
-  message: $src_user$ has created a new API token within Okta.
-  observable:
-  - name: src_user
-    type: User
-    role:
-    - Attacker
-  kill_chain_phases:
-  - Exploitation
diff --git a/detections/experimental/application/okta_new_device_enrolled_on_account.yml b/detections/experimental/application/okta_new_device_enrolled_on_account.yml
deleted file mode 100644
index 4bc92cb62c..0000000000
--- a/detections/experimental/application/okta_new_device_enrolled_on_account.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: Okta New Device Enrolled on Account
-id: bb27cbce-d4de-432c-932f-2e206e9130fb
-version: 1
-date: '2022-09-21'
-author: Michael Haag, Splunk
-type: Anomaly
-datamodel: []
-description: The following anomaly will be generated when a new device is added to an account. Albeit not malicious, risk is set low, but should be monitored. This anomaly utilizes the legacy events from Okta.
-search: '`okta` eventType=system.email.new_device_notification.sent_message
-displayMessage="Send user new device notification email"
-  | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser client.geographicalContext.city client.geographicalContext.country
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `okta_new_device_enrolled_on_account_filter`'
-how_to_implement: This analytic is specific to Okta and requires Okta logs to be
-  ingested.
-known_false_positives: Tune the risk score as needed based on your organization.
-references:
-  - https://developer.okta.com/docs/reference/api/event-types/?q=system.email.new_device_notification.sent_message
-tags:
-  analytic_story:
-  - Suspicious Okta Activity
-  asset_type: Infrastructure
-  cis20:
-  - CIS 16
-  mitre_attack_id:
-  - T1078
-  - T1078.001
-  nist:
-  - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - displayMessage
-  - user
-  - eventType
-  - client.userAgent.rawUserAgent 
-  - client.userAgent.browser 
-  - client.geographicalContext.city 
-  - client.geographicalContext.country
-  security_domain: access
-  confidence: 60
-  impact: 40
-  risk_score: 24
-  context: []
-  message: $user$ has added a new device to their account.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  kill_chain_phases:
-  - Exploitation
diff --git a/detections/experimental/application/okta_suspicious_activity_reported.yml b/detections/experimental/application/okta_suspicious_activity_reported.yml
deleted file mode 100644
index 4556d935fa..0000000000
--- a/detections/experimental/application/okta_suspicious_activity_reported.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: Okta Suspicious Activity Reported
-id: bfc840f5-c9c6-454c-aa13-b46fd0bf1e79
-version: 1
-date: '2022-09-21'
-author: Michael Haag, Splunk
-type: TTP
-datamodel: []
-description: The following event is generated when an associate receives an email from Okta asking if a login attempt was suspicious or not. If the associate identifies it as suspicious an event is generated and should be reviewed.
-search: '`okta` eventType=user.account.report_suspicious_activity_by_enduser 
-  | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser client.geographicalContext.city client.geographicalContext.country
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `okta_suspicious_activity_reported_filter`'
-how_to_implement: This analytic is specific to Okta and requires Okta logs to be
-  ingested. It also requires that suspicious activity reporting is enabled and associates are trained to submit.
-known_false_positives: False positives should be limited as this is a high fidelity marker.
-references:
-  - https://help.okta.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm
-tags:
-  analytic_story:
-  - Suspicious Okta Activity
-  asset_type: Infrastructure
-  cis20:
-  - CIS 16
-  mitre_attack_id:
-  - T1078
-  - T1078.001
-  nist:
-  - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - displayMessage
-  - user
-  - eventType
-  - client.userAgent.rawUserAgent 
-  - client.userAgent.browser 
-  - client.geographicalContext.city 
-  - client.geographicalContext.country
-  security_domain: access
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context: []
-  message: The following $user$ has reported a suspicious login activity.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  kill_chain_phases:
-  - Exploitation
diff --git a/detections/experimental/application/okta_threatinsight_threat_detected.yml b/detections/experimental/application/okta_threatinsight_threat_detected.yml
deleted file mode 100644
index 8a57d66c36..0000000000
--- a/detections/experimental/application/okta_threatinsight_threat_detected.yml
+++ /dev/null
@@ -1,60 +0,0 @@
-name: Okta ThreatInsight Threat Detected
-id: 140504ae-5fe2-4d65-b2bc-a211813fbca6
-version: 1
-date: '2022-09-21'
-author: Michael Haag, Splunk
-type: Anomaly
-datamodel: []
-description: The following anomaly relies on the Okta ThreatInsight identification of a threat. Use this to drive risk up by src_ip or add additional fields to track. Identification may include password spraying, login failures and Login failures with high unknown users count.
-search: '`okta` eventType IN (security.threat.detected, security.internal.threat.detected) 
-  | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city
-  | stats values(src_ip) count by signature eventType displayMessage client.device city state country user_agent outcome.reason outcome.result severity 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `okta_threatinsight_threat_detected_filter`'
-how_to_implement: This analytic is specific to Okta and requires Okta logs to be
-  ingested.
-known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed.
-references:
-  - https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected
-tags:
-  analytic_story:
-  - Suspicious Okta Activity
-  asset_type: Infrastructure
-  cis20:
-  - CIS 16
-  mitre_attack_id:
-  - T1078
-  - T1078.001
-  nist:
-  - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - signature 
-  - eventType 
-  - displayMessage
-  - client.device 
-  - city
-  - state
-  - country
-  - user_agent
-  - outcome.reason
-  - outcome.result 
-  - severity 
-  security_domain: access
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context: []
-  message: The following $src_ip$ has been conisidered a threat by Okta ThreatInsight.
-  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  kill_chain_phases:
-  - Exploitation
diff --git a/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml b/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
deleted file mode 100644
index c0d6910f42..0000000000
--- a/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: Okta Two or More Rejected Okta Pushes
-id: d93f785e-4c2c-4262-b8c7-12b77a13fd39
-version: 1
-date: '2022-09-27'
-author: Michael Haag, Splunk
-type: TTP
-datamodel: []
-description: The following analytic identifies an account that has rejected more than 2 Push notifications in a 10 minute window. 
-  Modify this query for your environment by upping the count or time window.
-search: '`okta` outcome.reason="User rejected Okta push verify" OR (debugContext.debugData.factor="OKTA_VERIFY_PUSH" outcome.result=FAILURE legacyEventType="core.user.factor.attempt_fail" "target{}.detailEntry.methodTypeUsed"="Get a push notification") 
-  | bin _time as bin_time span=10m 
-  | eval user=coalesce(actor.alternateId,user), user=mvindex(split(user, "@"), 0), event_time = _time 
-  | stats earliest(event_time) as event_time, min(_time) as firsttime max(_time) as lasttime values(client.ipAddress) as client.ipAddress, values(outcome.reason) as outcome, values(src_ip) AS src_ip, values(client.userAgent.rawUserAgent) as user_agent, values(eventType) as eventType, values(outcome.result) as action, values(legacyEventType) as legacyEventType values(index) as idx, values(sourcetype) as st count by bin_time user host 
-  | rename bin_time as timeWindow 
-  | convert ctime(*timeWindow) ctime(firsttime) ctime(lasttime) 
-  | where count >= 2
-  | `okta_two_or_more_rejected_okta_pushes_filter`'
-how_to_implement: This analytic is specific to Okta and requires Okta logs to be
-  ingested.
-known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed. Drop to anomaly until tuning is complete.
-references:
-  - https://developer.okta.com/docs/reference/api/event-types/?q=user.acount.lock
-tags:
-  analytic_story:
-  - Suspicious Okta Activity
-  - Okta MFA Exhaustion
-  asset_type: Infrastructure
-  cis20:
-  - CIS 16
-  mitre_attack_id:
-  - T1110
-  nist:
-  - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - src_user 
-  - src_ip 
-  - eventType 
-  - status
-  security_domain: access
-  confidence: 80
-  impact: 80
-  risk_score: 64
-  context: []
-  message: $src_user$ account has rejected multiple Okta pushes.
-  observable:
-  - name: src_user
-    type: User
-    role:
-    - Attacker
-  kill_chain_phases:
-  - Exploitation
diff --git a/stories/okta_mfa_exhaustion.yml b/stories/okta_mfa_exhaustion.yml
deleted file mode 100644
index 8a327e6b40..0000000000
--- a/stories/okta_mfa_exhaustion.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: Okta MFA Exhaustion
-id: 7c6e508d-4b4d-42c8-82de-5ff4ea3b0cb3
-version: 1
-date: '2022-09-27'
-author: Michael Haag, Splunk
-description: A social engineering technique called 'MFA Fatigue', aka 'MFA push spam' or 'MFA Exhaustion', is growing more popular with threat actors as it does not require malware or phishing infrastructure and has proven to be successful in attacks.
-narrative: An MFA Fatigue attack is when a threat actor runs a script that attempts to log in with stolen credentials over and over, causing what feels like an endless stream of MFA push requests to be sent to the account's owner's mobile device.
-  The goal is to keep this up, day and night, to break down the target's cybersecurity posture and inflict a sense of "fatigue" regarding these MFA prompts.
-references: 
-  - https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/
-  - https://www.csoonline.com/article/3674156/multi-factor-authentication-fatigue-attacks-are-on-the-rise-how-to-defend-against-them.html
-tags:
-  analytic_story: Okta MFA Exhaustion
-  category: 
-  - Adversary Tactics
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Advanced Threat Detection

From 9ad1b64934828d9ab597eea7577d8edfd292aed6 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 29 Sep 2022 11:48:15 -0600
Subject: [PATCH 10/13] Revert "Okta"

This reverts commit 3a1f0aadc7d9f8abdb2fcc2d2e446063394c776b.
---
 ...h_invalid_credentials_from_the_same_ip.yml | 37 +++++++++----------
 .../okta_account_lockout_events.yml           | 29 ++++++---------
 .../application/okta_failed_sso_attempts.yml  | 27 +++++++-------
 3 files changed, 41 insertions(+), 52 deletions(-)

diff --git a/detections/experimental/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml b/detections/experimental/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml
index e0bea1863a..c879649f3e 100644
--- a/detections/experimental/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml
+++ b/detections/experimental/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml
@@ -1,28 +1,25 @@
 name: Multiple Okta Users With Invalid Credentials From The Same IP
 id: 19cba45f-cad3-4032-8911-0c09e0444552
-version: 3
-date: '2022-09-21'
-author: Michael Haag, Rico Valdez, Splunk
-type: Hunting
+version: 2
+date: '2020-07-21'
+author: Rico Valdez, Splunk
+type: TTP
 datamodel: []
-description: This hunting analytic identifies multiple failed logon attempts from a single IP. Use this analytic to identify patterns of suspicious logins from a single source and filter as needed or use this to drive tuning for higher fidelity analytics.
-search: '`okta` outcome.reason=INVALID_CREDENTIALS 
-  | rename client.geographicalContext.country
+description: This search detects Okta login failures due to bad credentials for multiple
+  users originating from the same ip address.
+search: '`okta` outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country
   as country, client.geographicalContext.state as state, client.geographicalContext.city
-  as city 
-  | stats min(_time) as firstTime max(_time) as lastTime dc(src_user) as distinct_users
-  values(src_user) as users by src_ip, displayMessage, outcome.reason, country, state,
-  city 
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | search distinct_users > 5| `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` '
+  as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users
+  values(user) as users by src_ip, displayMessage, outcome.reason, country, state,
+  city  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  |  search distinct_users > 5| `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` '
 how_to_implement: This search is specific to Okta and requires Okta logs are being
   ingested in your Splunk deployment.
 known_false_positives: A single public IP address servicing multiple legitmate users
   may trigger this search. In addition, the threshold of 5 distinct users may be too
   low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter`
   to raise the threshold or except specific IP adresses from triggering this search.
-references:
-  - https://developer.okta.com/docs/reference/api/event-types/?q=INVALID_CREDENTIALS
+references: []
 tags:
   analytic_story:
   - Suspicious Okta Activity
@@ -48,13 +45,13 @@ tags:
   - src_ip
   - displayMessage
   security_domain: access
-  confidence: 30
-  impact: 30
-  risk_score: 9
+  confidence: 50
+  impact: 50
+  risk_score: 25
   context: []
-  message: Multple user accounts have failed to authenticate from a single IP.
+  message: tbd
   observable:
-  - name: src_user
+  - name: user
     type: User
     role:
     - Victim
diff --git a/detections/experimental/application/okta_account_lockout_events.yml b/detections/experimental/application/okta_account_lockout_events.yml
index 80664492d4..0a42a1e4f1 100644
--- a/detections/experimental/application/okta_account_lockout_events.yml
+++ b/detections/experimental/application/okta_account_lockout_events.yml
@@ -1,25 +1,20 @@
 name: Okta Account Lockout Events
 id: 62b70968-a0a5-4724-8ac4-67871e6f544d
 version: 2
-date: '2022-09-19'
-author: Michael Haag, Rico Valdez, Splunk
+date: '2020-07-21'
+author: Rico Valdez, Splunk
 type: Anomaly
 datamodel: []
-description: The following anomaly will generate based on account lockout events utilizing Okta eventTypes of user.account.lock.limit or user.account.lock. Per the Okta docs site, this event is fired when a user account has reached the lockout limit. The account will not auto-unlock and a user or client cannot gain access to the account. This event indicates an account that will not be able to log in until remedial action is taken by the account admin. This event can be used to understand the specifics of an account lockout. Often this indicates a client application that is repeatedly attempting to authenticate with invalid credentials such as an old password.
-search: '`okta` eventType IN (user.account.lock.limit,user.account.lock)
-  | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city
-  | stats count min(_time) as firstTime max(_time) as lastTime values(src_user) by displayMessage, country, state, city, src_ip
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `okta_account_lockout_events_filter`'
-how_to_implement: This analytic is specific to Okta and requires Okta logs to be
-  ingested.
+description: Detect Okta user lockout events
+search: '`okta` displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country
+  as country, client.geographicalContext.state as state, client.geographicalContext.city
+  as city | table _time, user, country, state, city, src_ip | `okta_account_lockout_events_filter` '
+how_to_implement: This search is specific to Okta and requires Okta logs are being
+  ingested in your Splunk deployment.
 known_false_positives: None. Account lockouts should be followed up on to determine
   if the actual user was the one who caused the lockout, or if it was an unauthorized
   actor.
-references:
-  - https://developer.okta.com/docs/reference/api/event-types/#catalog
-  - https://developer.okta.com/docs/reference/api/event-types/?q=user.account.lock
+references: []
 tags:
   analytic_story:
   - Suspicious Okta Activity
@@ -41,16 +36,14 @@ tags:
   - client.geographicalContext.country
   - client.geographicalContext.state
   - client.geographicalContext.city
-  - src_ip
-  - src_user
   security_domain: access
   confidence: 50
   impact: 50
   risk_score: 25
   context: []
-  message: The following user $src_user$ has locked out their account within Okta.
+  message: tbd
   observable:
-  - name: src_user
+  - name: user
     type: User
     role:
     - Victim
diff --git a/detections/experimental/application/okta_failed_sso_attempts.yml b/detections/experimental/application/okta_failed_sso_attempts.yml
index 3539428e6b..b3254a1d38 100644
--- a/detections/experimental/application/okta_failed_sso_attempts.yml
+++ b/detections/experimental/application/okta_failed_sso_attempts.yml
@@ -1,21 +1,20 @@
 name: Okta Failed SSO Attempts
 id: 371a6545-2618-4032-ad84-93386b8698c5
-version: 3
-date: '2022-09-21'
-author: Michael Haag, Rico Valdez, Splunk
+version: 2
+date: '2020-07-21'
+author: Rico Valdez, Splunk
 type: Anomaly
 datamodel: []
-description: The following anomaly identifies failed Okta SSO events utilizing the legacy Okta event "unauth app access attempt". 
-search: '`okta` eventType=app.generic.unauth_app_access_attempt | stats min(_time)
-  as firstTime max(_time) as lastTime values(app) as Apps count by src_user, result ,displayMessage,
+description: Detect failed Okta SSO events
+search: '`okta` displayMessage="User attempted unauthorized access to app" | stats  min(_time)
+  as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage,
   src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `okta_failed_sso_attempts_filter` '
 how_to_implement: This search is specific to Okta and requires Okta logs are being
   ingested in your Splunk deployment.
 known_false_positives: There may be a faulty config preventing legitmate users from
   accessing apps they should have access to.
-references:
-  - https://developer.okta.com/docs/reference/api/event-types/?q=app.generic.unauth_app_access_attempt
+references: []
 tags:
   analytic_story:
   - Suspicious Okta Activity
@@ -35,17 +34,17 @@ tags:
   - _time
   - displayMessage
   - app
-  - src_user
+  - user
   - result
   - src_ip
   security_domain: access
-  confidence: 40
-  impact: 40
-  risk_score: 16
+  confidence: 50
+  impact: 50
+  risk_score: 25
   context: []
-  message: $src_user$ failed SSO authentication to the app.
+  message: tbd
   observable:
-  - name: src_user
+  - name: user
     type: User
     role:
     - Victim

From b199bed2e8c052c328fd08e40bff291cd64d1c4c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 1 Oct 2022 23:00:57 +0000
Subject: [PATCH 11/13] Bump splunk-appinspect from 2.25.0 to 2.26.0

Bumps [splunk-appinspect](https://splunk.com) from 2.25.0 to 2.26.0.

---
updated-dependencies:
- dependency-name: splunk-appinspect
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index b8d35df335..65f121dc86 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -12,7 +12,7 @@ PyYAML==5.4.1
 questionary==1.10.0
 requests==2.28.1
 six==1.16.0
-splunk-appinspect==2.25.0
+splunk-appinspect==2.26.0
 splunk-sdk==1.7.2
 wrapt-timeout-decorator==1.3.12.2
 xmltodict==0.13.0

From 1e47db984d124a3d04184602ec93d9160df9d9c3 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Sun, 2 Oct 2022 06:55:20 -0600
Subject: [PATCH 12/13] Update exchange_powershell_module_usage.yml

Resolving #2396
---
 .../experimental/endpoint/exchange_powershell_module_usage.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/experimental/endpoint/exchange_powershell_module_usage.yml b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
index 9cee336fb3..d04eae8669 100644
--- a/detections/experimental/endpoint/exchange_powershell_module_usage.yml
+++ b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
@@ -23,7 +23,7 @@ description: 'The following analytic identifies the usage of Exchange PowerShell
   Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \
   Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).'
 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*", "*New-MailboxSearch*", "*Get-Recipient*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by lastTime by Opcode Computer
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer
   UserID EventCode ScriptBlockText| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `exchange_powershell_module_usage_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable

From d51a604303822d2f75a91c01870b7918d5884972 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 3 Oct 2022 09:24:24 -0600
Subject: [PATCH 13/13] updates

---
 .../office_product_spawning_windows_script_host.yml       | 8 ++++++--
 .../windows_com_hijacking_inprocserver32_modification.yml | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml
index 9905c7081f..9c2dba2783 100644
--- a/detections/endpoint/office_product_spawning_windows_script_host.yml
+++ b/detections/endpoint/office_product_spawning_windows_script_host.yml
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic will identify a Windows Office Product spawning WScript or CScript. 
+description: The following analytic will identify a Windows Office Product spawning WScript.exe or CScript.exe. Tuning may be required based on legitimate application usage that may spawn scripts from an Office product.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name IN ("wscript.exe", "cscript.exe")
@@ -40,10 +40,14 @@ tags:
     type: Hostname
     role:
     - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
   - name: process_name
     type: Process
     role:
-    - Attacker
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
index abb0f714ff..05109086c8 100644
--- a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
+++ b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the use of reg.exe performing an add to the InProcServer32, which is related to COM hijacking.
+description: The following analytic identifies the use of reg.exe performing an add to the InProcServer32, which may be related to COM hijacking.
   Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_reg`