From d445133a16634be69e6ea50de813ba654d49d8c8 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-142-201>
Date: Thu, 23 Sep 2021 08:07:07 +0000
Subject: [PATCH] Added detection testing service results inSuspicious Image
 Creation In Appdata Folder

---
 ...cious_image_creation_in_appdata_folder.yml | 29 ++++++++++---------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
index 8709b98427..dbbc13c1e0 100644
--- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
+++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
@@ -6,27 +6,30 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious creation of image in appdata folder made by process that also has a file reference in appdata folder. 
-  This technique was seen in remcos rat that capture screenshot of the compromised machine and place it in the appdata and will be send to its C2 server.
-  This TTP is really a good indicator to check that process because it is in suspicious folder path and image files are not commonly created by user in this folder path.
+description: This search is to detect a suspicious creation of image in appdata folder
+  made by process that also has a file reference in appdata folder. This technique
+  was seen in remcos rat that capture screenshot of the compromised machine and place
+  it in the appdata and will be send to its C2 server. This TTP is really a good indicator
+  to check that process because it is in suspicious folder path and image files are
+  not commonly created by user in this folder path.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
   by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
   | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
   count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-  where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path = "*\\appdata\\Roaming\\*"
-  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
-  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
-  file_name file_path process_name process_path process] 
-  | `suspicious_image_creation_in_appdata_folder_filter`'
+  where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path
+  = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time
+  Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` |
+  fields _time dest file_create_time file_name file_path process_name process_path
+  process] | `suspicious_image_creation_in_appdata_folder_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
 known_false_positives: unknown
 references:
--  https://success.trendmicro.com/solution/1123281-remcos-malware-information
--  https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
+- https://success.trendmicro.com/solution/1123281-remcos-malware-information
+- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
 tags:
   analytic_story:
   - Remcos
@@ -44,7 +47,7 @@ tags:
   - _time
   - dest
   - file_create_time
-  - file_name 
+  - file_name
   - file_path
   - process_name
   - process_path
@@ -52,7 +55,6 @@ tags:
   security_domain: endpoint
   impact: 70
   confidence: 70
-  # (impact * confidence)/100
   risk_score: 49
   context:
   - Source:Endpoint
@@ -66,4 +68,5 @@ tags:
   - name: process_name
     type: process name
     role:
-    - Attacker
\ No newline at end of file
+    - Attacker
+  automated_detection_testing: passed