Delete prevent_automatic_repair_mode_using_bcdedit.yml

detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml

@@ -1,45 +0,0 @@
-name: Prevent Automatic Repair Mode using Bcdedit
-id: 7742aa92-c9d9-11eb-bbfc-acde48001122
-version: 1
-date: '2021-06-10'
-author: Teoderick Contreras, Splunk
-type: batch
-datamodel:
-- Endpoint
-description: This search is to detect a suspicious bcdedit.exe execution to ignore all failures.
-  This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name = "bcdedit.exe" Processes.process = "*bootstatuspolicy*"  Processes.process = "*ignoreallfailures*" 
-  by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`| `prevent_automatic_repair_mode_using_bcdedit_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used.
-known_false_positives: Administrators may modify the boot configuration ignore failure during testing and debugging.
-references:
-- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf
-tags:
-  analytic_story:
-  - Ransomware
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1490
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.process_id
-  - Processes.process_guid
-  security_domain: endpoint