Merge branch 'develop' into output_normalization_aws

2026-06-08 17:32:49 +00:00 · 2025-03-13 11:10:04 -07:00
parent 1f3447817f 9c3fd5dcee
commit 9b112cabc6
33 changed files with 1029 additions and 135 deletions
@@ -0,0 +1,16 @@
+name: Windows Event Log Security 4700
+id: 89895c7b-2aba-41ca-ad12-8b6d290b5dde
+version: 1
+date: '2025-03-11'
+author: Steven Dick
+description: Data source object for Windows Event Log Security 4700
+source: XmlWinEventLog:Security
+sourcetype: xmlwineventlog
+separator: EventID
+supported_TA:
+- name: Splunk Add-on for Microsoft Windows
+  url: https://splunkbase.splunk.com/app/742
+  version: 9.0.1
+fields:
+- EventID
+example_log: '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />  <EventID>4700</EventID>  <Version>0</Version>  <Level>0</Level>  <Task>12804</Task>  <Opcode>0</Opcode>  <Keywords>0x8020000000000000</Keywords>  <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" />  <EventRecordID>344861</EventRecordID>  <Correlation />  <Execution ProcessID="516" ThreadID="756" />  <Channel>Security</Channel>  <Computer>DC01.contoso.local</Computer>  <Security />  </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data>  <Data Name="SubjectUserName">dadmin</Data>  <Data Name="SubjectDomainName">CONTOSO</Data>  <Data Name="SubjectLogonId">0x364eb</Data>  <Data Name="TaskName">\\Microsoft\\StartListener</Data>  <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data>  </EventData> </Event>'
@@ -0,0 +1,16 @@
+name: Windows Event Log Security 4702
+id: 167e378e-3675-4042-b611-d3bfb6d2abc7
+version: 1
+date: '2025-03-11'
+author: Steven Dick
+description: Data source object for Windows Event Log Security 4702
+source: XmlWinEventLog:Security
+sourcetype: xmlwineventlog
+separator: EventID
+supported_TA:
+- name: Splunk Add-on for Microsoft Windows
+  url: https://splunkbase.splunk.com/app/742
+  version: 9.0.1
+fields:
+- EventID
+example_log: '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />  <EventID>4702</EventID>  <Version>0</Version>  <Level>0</Level>  <Task>12804</Task>  <Opcode>0</Opcode>  <Keywords>0x8020000000000000</Keywords>  <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" />  <EventRecordID>344863</EventRecordID>  <Correlation />  <Execution ProcessID="516" ThreadID="596" />  <Channel>Security</Channel>  <Computer>DC01.contoso.local</Computer>  <Security />  </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data>  <Data Name="SubjectUserName">dadmin</Data>  <Data Name="SubjectDomainName">CONTOSO</Data>  <Data Name="SubjectLogonId">0x364eb</Data>  <Data Name="TaskName">\\Microsoft\\StartListener</Data>  <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data>  </EventData> </Event>'
@@ -0,0 +1,58 @@
+name: O365 BEC Email Hiding Rule Created
+id: 603ebac2-f157-4df7-a6ac-34e8d0350f86
+version: 1
+date: '2025-02-14'
+author: '0xC0FFEEEE, Github Community'
+type: TTP
+status: production
+description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers.
+  This may indicate that an attacker has gained access to the account.
+search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" |
+  stats values(Name) as Name, values(MarkAsRead) as MarkAsRead, values(MoveToFolder)
+  as MoveToFolder by _time Id user | lookup ut_shannon_lookup word as Name | eval
+  entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,0) | eval
+  read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder,
+  "^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score
+  | where suspicious_score>2 | `o365_bec_email_hiding_rule_created_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest
+  Office 365 management activity events. You also need to have the Splunk TA URL 
+  Toolbox (https://splunkbase.splunk.com/app/2734/) installed.
+known_false_positives: Short rule names may trigger false positives. Adjust
+  the entropy and length thresholds as needed.
+references:
+- https://attack.mitre.org/techniques/T1564/008/
+drilldown_searches:
+- name: View the detection results for - "$user$"
+  search: '%original_detection_search% | search  dest = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for $user$
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user$" starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Potential BEC mailbox rule was created by $user$
+  risk_objects:
+  - field: user
+    type: user
+    score: 25
+  threat_objects:
+  - field: Name
+    type: signature
+tags:
+  analytic_story:
+  - Office 365 Account Takeover
+  asset_type: O365 Tenant
+  mitre_attack_id:
+  - T1564.008
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: audit
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.008/o365/o365_suspicious_mailbox_rule.log
+    sourcetype: o365:management:activity
+    source: o365
@@ -1,7 +1,7 @@
 name: Detect Rare Executables
 id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac
-version: 7
-date: '2024-11-13'
+version: '8'
+date: '2025-02-07'
 author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
@@ -58,9 +58,12 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
-  - Unusual Processes
+  - SnappyBee
  - Rhysida Ransomware
+  - China-Nexus Threat Activity
  - Crypto Stealer
+  - Earth Estries
+  - Unusual Processes
  asset_type: Endpoint
  mitre_attack_id:
  - T1204
@@ -72,7 +75,6 @@ tags:
 tests:
 - name: True Positive Test
  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/rare_executables/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/rare_executables/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: XmlWinEventLog
@@ -15,15 +15,14 @@ description: The following analytic identifies the creation of executables or sc
  a significant security threat.
 data_source:
 - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as
-  file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
-  where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe",
-  "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*",
-  "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*",
-  "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*",
-  "*\\Windows\\repair\\*", "*\\AppData\\Local\\Temp*", "*\\PerfLogs\\*", "*:\\temp\\*")
+search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
+  where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") 
+  AND Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*",
+  "*\\Windows\\repair\\*", "*\\PerfLogs\\*") AND NOT(Filesystem.file_path IN("*\\temp\\*"))
  by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user
-  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `drop_dm_object_name(Filesystem)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
  | `executables_or_script_creation_in_suspicious_path_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
@@ -100,6 +99,7 @@ tags:
  - Azorult
  - Data Destruction
  - Amadey
+  - SnappyBee
  - WhisperGate
  asset_type: Endpoint
  mitre_attack_id:
@@ -112,6 +112,6 @@ tags:
 tests:
 - name: True Positive Test
  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path2.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: XmlWinEventLog
@@ -0,0 +1,116 @@
+name: Executables Or Script Creation In Temp Path
+id: e0422b71-2c05-4f32-8754-01fb415f49c9
+version: 11
+date: '2025-02-11'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: The following analytic identifies the creation of executables or scripts
+  in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem
+  data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created
+  in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is
+  significant as adversaries often use these paths to evade detection and maintain
+  persistence. If confirmed malicious, this behavior could allow attackers to execute
+  unauthorized code, escalate privileges, or persist within the environment, posing
+  a significant security threat.
+data_source:
+- Sysmon EventID 11
+search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
+  where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") 
+  AND Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*", "*:\\Windows\\Temp\\*", "*:\\Temp*")
+  by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user
+  | `drop_dm_object_name(Filesystem)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `executables_or_script_creation_in_temp_path_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: Administrators may allow creation of script or exe in the paths
+  specified. Filter as needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+- https://twitter.com/pr0xylife/status/1590394227758104576
+- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
+drilldown_searches:
+- name: View the detection results for - "$user$"
+  search: '%original_detection_search% | search  user = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$")
+    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Potentially suspicious executable or script with file name $file_name$, $file_path$
+    and process_id $process_id$ was created in temporary folder by $user$
+  risk_objects:
+  - field: user
+    type: user
+    score: 20
+  threat_objects:
+  - field: file_name
+    type: file_name
+tags:
+  analytic_story:
+  - Chaos Ransomware
+  - Trickbot
+  - Snake Keylogger
+  - CISA AA23-347A
+  - Industroyer2
+  - WinDealer RAT
+  - Qakbot
+  - Warzone RAT
+  - IcedID
+  - ValleyRAT
+  - Azorult
+  - Handala Wiper
+  - LockBit Ransomware
+  - Meduza Stealer
+  - Brute Ratel C4
+  - AsyncRAT
+  - AcidPour
+  - Derusbi
+  - DarkGate Malware
+  - Graceful Wipe Out Attack
+  - NjRAT
+  - WhisperGate
+  - Data Destruction
+  - BlackByte Ransomware
+  - AgentTesla
+  - Swift Slicer
+  - Crypto Stealer
+  - Hermetic Wiper
+  - MoonPeak
+  - Double Zero Destructor
+  - XMRig
+  - PlugX
+  - Amadey
+  - DarkCrystal RAT
+  - Remcos
+  - China-Nexus Threat Activity
+  - Earth Estries
+  - Rhysida Ransomware
+  - RedLine Stealer
+  - Volt Typhoon
+  - SnappyBee
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1036
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -58,12 +58,12 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
-  - Linux Privilege Escalation
-  - Linux Living Off The Land
-  - Compromised Linux Host
+  - China-Nexus Threat Activity
  - Linux Persistence Techniques
  - XorDDos
-  - China-Nexus Threat Activity
+  - Linux Privilege Escalation
+  - Compromised Linux Host
+  - Linux Living Off The Land
  - Earth Estries
  asset_type: Endpoint
  mitre_attack_id:
@@ -80,3 +80,4 @@ tests:
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/auditd_proctitle_chmod.log
    source: auditd
    sourcetype: auditd
+
@@ -57,10 +57,10 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
  - Linux Privilege Escalation
  - Compromised Linux Host
-  - Linux Persistence Techniques
-  - China-Nexus Threat Activity
  - Earth Estries
  asset_type: Endpoint
  mitre_attack_id:
@@ -77,3 +77,4 @@ tests:
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd2.log
    source: auditd
    sourcetype: auditd
+
@@ -57,10 +57,10 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
  - Linux Privilege Escalation
  - Compromised Linux Host
-  - Linux Persistence Techniques
-  - China-Nexus Threat Activity
  - Earth Estries
  asset_type: Endpoint
  mitre_attack_id:
@@ -76,3 +76,4 @@ tests:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/auditd_proctitle_access_cred.log      
    source: auditd
    sourcetype: auditd
+
@@ -56,10 +56,10 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
  - Linux Privilege Escalation
  - Compromised Linux Host
-  - Linux Persistence Techniques
-  - China-Nexus Threat Activity
  - Earth Estries
  asset_type: Endpoint
  mitre_attack_id:
@@ -76,3 +76,4 @@ tests:
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log
    source: auditd
    sourcetype: auditd
+
@@ -59,10 +59,10 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
  - Linux Privilege Escalation
  - Compromised Linux Host
-  - Linux Persistence Techniques
-  - China-Nexus Threat Activity
  - Earth Estries
  asset_type: Endpoint
  mitre_attack_id:
@@ -79,3 +79,4 @@ tests:
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/auditd_execve_ldpreload.log
    source: auditd
    sourcetype: auditd
+
@@ -49,19 +49,20 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
-  - Warzone RAT
-  - NjRAT
-  - China-Nexus Threat Activity
-  - FIN7
-  - Snake Keylogger
-  - 3CX Supply Chain Attack
-  - CISA AA23-347A
-  - AgentTesla
+  - SnappyBee
  - Phemedrone Stealer
-  - DarkGate Malware
-  - RedLine Stealer
-  - Remcos
+  - Snake Keylogger
+  - NjRAT
+  - CISA AA23-347A
+  - 3CX Supply Chain Attack
+  - FIN7
  - Earth Estries
+  - Warzone RAT
+  - China-Nexus Threat Activity
+  - DarkGate Malware
+  - Remcos
+  - RedLine Stealer
+  - AgentTesla
  asset_type: Endpoint
  mitre_attack_id:
  - T1555.003
@@ -1,7 +1,7 @@
 name: Non Firefox Process Access Firefox Profile Dir
 id: e6fc13b0-1609-11ec-b533-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -48,18 +48,21 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
-  - Azorult
-  - Remcos
-  - NjRAT
-  - Warzone RAT
-  - 3CX Supply Chain Attack
-  - RedLine Stealer
-  - FIN7
-  - DarkGate Malware
-  - AgentTesla
-  - CISA AA23-347A
+  - SnappyBee
  - Phemedrone Stealer
  - Snake Keylogger
+  - NjRAT
+  - CISA AA23-347A
+  - 3CX Supply Chain Attack
+  - Azorult
+  - China-Nexus Threat Activity
+  - Warzone RAT
+  - AgentTesla
+  - RedLine Stealer
+  - DarkGate Malware
+  - Remcos
+  - Earth Estries
+  - FIN7
  asset_type: Endpoint
  mitre_attack_id:
  - T1555.003
@@ -71,7 +74,6 @@ tags:
 tests:
 - name: True Positive Test
  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/non_chrome_process_accessing_chrome_default_dir/windows-xml.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/non_chrome_process_accessing_chrome_default_dir/windows-xml.log
    source: XmlWinEventLog:Security
    sourcetype: XmlWinEventLog
@@ -76,35 +76,37 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
-  - BlackByte Ransomware
-  - DHS Report TA18-074A
-  - Snake Keylogger
-  - Emotet Malware DHS Report TA18-201A
-  - Sneaky Active Directory Persistence Tricks
-  - Warzone RAT
-  - NjRAT
-  - Suspicious MSHTA Activity
-  - Suspicious Windows Registry Activities
-  - Braodo Stealer
-  - AsyncRAT
-  - Windows Registry Abuse
-  - Chaos Ransomware
-  - Derusbi
-  - Windows Persistence Techniques
-  - WinDealer RAT
-  - RedLine Stealer
-  - Remcos
  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
-  - China-Nexus Threat Activity
-  - Qakbot
-  - IcedID
-  - Ransomware
-  - BlackSuit Ransomware
  - MoonPeak
-  - CISA AA23-347A
-  - DarkGate Malware
-  - Azorult
  - Amadey
+  - RedLine Stealer
+  - Emotet Malware DHS Report TA18-201A
+  - Chaos Ransomware
+  - WinDealer RAT
+  - Warzone RAT
+  - China-Nexus Threat Activity
+  - Earth Estries
+  - SnappyBee
+  - Windows Persistence Techniques
+  - Snake Keylogger
+  - Ransomware
+  - CISA AA23-347A
+  - DHS Report TA18-074A
+  - Windows Registry Abuse
+  - Sneaky Active Directory Persistence Tricks
+  - BlackSuit Ransomware
+  - Qakbot
+  - DarkGate Malware
+  - IcedID
+  - Braodo Stealer
+  - Suspicious MSHTA Activity
+  - NjRAT
+  - AsyncRAT
+  - Azorult
+  - Suspicious Windows Registry Activities
+  - Derusbi
+  - BlackByte Ransomware
+  - Remcos
  asset_type: Endpoint
  mitre_attack_id:
  - T1547.001
@@ -56,16 +56,17 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
+  - SnappyBee
  - ValleyRAT
-  - China-Nexus Threat Activity
  - Brute Ratel C4
-  - Derusbi
+  - WinDealer RAT
  - Meduza Stealer
  - CISA AA23-347A
-  - DarkGate Malware
-  - WinDealer RAT
-  - PlugX
  - AsyncRAT
+  - Derusbi
+  - PlugX
+  - China-Nexus Threat Activity
+  - DarkGate Malware
  - Earth Estries
  asset_type: Endpoint
  mitre_attack_id:
@@ -0,0 +1,55 @@
+name: Windows Anonymous Pipe Activity
+id: ee301e1e-cd81-4011-a911-e5f049b9e3d5
+version: 1
+date: '2025-02-11'
+author: Teoderick Contreras, Splunk
+status: production
+type: Hunting
+description: The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
+data_source:
+- Sysmon EventID 17
+- Sysmon EventID 18
+search: '`sysmon` EventCode IN (17,18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*"))
+  | stats  min(_time) as firstTime max(_time) as lastTime count by dest EventCode PipeName ProcessGuid ProcessId Image EventType 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_anonymous_pipe_activity_filter`'
+how_to_implement:  To successfully implement this search, you need to be ingesting
+  logs with the process name and pipename from your endpoints. If you are using Sysmon,
+  you must have at least version 6.0.4 of the Sysmon TA. .
+known_false_positives: Automation tool might use anonymous pipe for task orchestration or process communication.
+references:
+- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
+drilldown_searches:
+- name: View the detection results for - "$dest$"
+  search: '%original_detection_search% | search  dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+tags:
+  analytic_story:
+  - SnappyBee
+  - China-Nexus Threat Activity
+  - Earth Estries
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1559
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1559/anonymous_pipe/anonymouspipe.log
+    sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    source: XmlWinEventLog
@@ -1,7 +1,7 @@
 name: Windows Credential Access From Browser Password Store
 id: 72013a8e-5cea-408a-9d51-5585386b4d69
-version: 6
-date: '2024-12-10'
+version: '8'
+date: '2025-02-24'
 author: Teoderick Contreras, Bhavin Patel Splunk
 data_source:
 - Windows Event Log Security 4663
@@ -60,11 +60,14 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
-  - Snake Keylogger
+  - SnappyBee
  - MoonPeak
  - Braodo Stealer
-  - PXA Stealer
+  - Snake Keylogger
  - Meduza Stealer
+  - PXA Stealer
+  - China-Nexus Threat Activity
+  - Earth Estries
  asset_type: Endpoint
  mitre_attack_id:
  - T1012
@@ -76,7 +79,6 @@ tags:
 tests:
 - name: True Positive Test
  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/snakey_keylogger_outlook_reg_access/snakekeylogger_4663.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/snakey_keylogger_outlook_reg_access/snakekeylogger_4663.log
    source: XmlWinEventLog:Security
    sourcetype: XmlWinEventLog
@@ -51,19 +51,20 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
-  - Warzone RAT
-  - NjRAT
-  - China-Nexus Threat Activity
-  - Meduza Stealer
+  - SnappyBee
  - MoonPeak
-  - Snake Keylogger
-  - DarkGate Malware
  - Phemedrone Stealer
-  - RedLine Stealer
  - Braodo Stealer
-  - PXA Stealer
-  - Earth Estries
+  - Snake Keylogger
+  - Meduza Stealer
+  - NjRAT
  - Amadey
+  - PXA Stealer
+  - Warzone RAT
+  - China-Nexus Threat Activity
+  - DarkGate Malware
+  - RedLine Stealer
+  - Earth Estries
  asset_type: Endpoint
  mitre_attack_id:
  - T1012
@@ -52,19 +52,20 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
-  - Warzone RAT
-  - NjRAT
-  - China-Nexus Threat Activity
-  - Meduza Stealer
+  - SnappyBee
  - MoonPeak
-  - Snake Keylogger
-  - DarkGate Malware
  - Phemedrone Stealer
-  - RedLine Stealer
  - Braodo Stealer
-  - PXA Stealer
-  - Earth Estries
+  - Snake Keylogger
+  - Meduza Stealer
+  - NjRAT
  - Amadey
+  - PXA Stealer
+  - Warzone RAT
+  - China-Nexus Threat Activity
+  - DarkGate Malware
+  - RedLine Stealer
+  - Earth Estries
  asset_type: Endpoint
  mitre_attack_id:
  - T1012
@@ -0,0 +1,77 @@
+name: Windows Process Execution From ProgramData
+id: 237016fa-d8e6-47b4-80f9-70c4d42c72c0
+version: 1
+date: '2025-03-13'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: The following analytic identifies processes running from file paths within the ProgramData directory, a common location abused by adversaries for executing malicious code while evading detection. Threat actors often drop and execute payloads from this directory to bypass security controls, as it typically has write permissions for standard users. While this behavior can indicate malware execution or persistence techniques, it is important to note that some legitimate software, installers, and update mechanisms also run from ProgramData, leading to potential false positives. Security teams should validate detections by correlating with other indicators, such as unusual parent processes, unsigned binaries, or anomalous network activity.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_path = "*:\\ProgramData\\*"
+  by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_process_execution_from_programdata_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Administrators may allow execution of specific binaries in
+  non-standard paths. Filter as needed.
+references:
+- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
+drilldown_searches:
+- name: View the detection results for - "$dest$"
+  search: '%original_detection_search% | search  dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Suspicious process $process_name$ running from a process path-
+    $process_path$ on host- $dest$
+  risk_objects:
+  - field: dest
+    type: system
+    score: 25
+  threat_objects:
+  - field: parent_process_name
+    type: parent_process_name
+tags:
+  analytic_story:
+  - China-Nexus Threat Activity
+  - Earth Estries
+  - SnappyBee
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1036.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.005/process_in_programdata/exec_programdata.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -1,7 +1,7 @@
 name: Windows Query Registry Browser List Application
 id: 45ebd21c-f4bf-4ced-bd49-d25b6526cebb
-version: 4
-date: '2024-11-13'
+version: '5'
+date: '2025-02-07'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -51,7 +51,10 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
+  - SnappyBee
  - RedLine Stealer
+  - Earth Estries
+  - China-Nexus Threat Activity
  asset_type: Endpoint
  mitre_attack_id:
  - T1012
@@ -63,7 +66,6 @@ tags:
 tests:
 - name: True Positive Test
  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_list/ar3_4663_redline_reg.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_list/ar3_4663_redline_reg.log
    source: XmlWinEventLog:Security
    sourcetype: XmlWinEventLog
@@ -0,0 +1,75 @@
+name: Windows Scheduled Task with Suspicious Command
+id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3
+version: 1
+date: '2025-02-07'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript or from public folders such as Users, Temp, or ProgramData. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, enabled, or modified. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
+data_source: 
+- Windows Event Log Security 4698
+- Windows Event Log Security 4700
+- Windows Event Log Security 4702
+search: |-
+  `wineventlog_security` EventCode IN (4698,4700,4702)
+  | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)
+  | xmlkv TaskContent
+  | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode
+  | lookup windows_suspicious_tasks task_command as Command 
+  | where tool == "shell command use" OR tool == "suspicious paths"
+  | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_scheduled_task_with_suspicious_command_filter` 
+how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
+known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection.
+references:
+- https://attack.mitre.org/techniques/T1053/005/
+- https://www.ic3.gov/CSA/2023/231213.pdf
+- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/
+- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv
+drilldown_searches:
+- name: View the detection results for - "$dest$" and "$user$"
+  search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$" and "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: Investigate schedule tasks on $dest$ 
+  search: '`wineventlog_security` EventCode IN (4698,4700,4702) Computer="$dest$" Caller_User_Name="$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: A suspicious windows scheduled task named [$TaskName$] was detected on $dest$, this may be an indicator of [$tool$]
+  risk_objects: 
+  - field: dest
+    type: system
+    score: 70
+  - field: user
+    type: user
+    score: 70
+  threat_objects: 
+  - field: Command
+    type: signature
+tags:
+  analytic_story: 
+  - Scheduled Tasks
+  - Windows Persistence Techniques
+  - Ransomware
+  - Ryuk Ransomware
+  asset_type: Endpoint
+  mitre_attack_id: 
+  - T1053.005
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,75 @@
+name: Windows Scheduled Task with Suspicious Name
+id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e
+version: 1
+date: '2025-02-07'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic detects the creation, modification, or enabling of scheduled tasks with known suspicious or malicious task names. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, modified, or enabled. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
+data_source: 
+- Windows Event Log Security 4698
+- Windows Event Log Security 4700
+- Windows Event Log Security 4702
+search: |-
+  `wineventlog_security` EventCode IN (4698,4700,4702)
+  | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)
+  | xmlkv TaskContent
+  | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, TaskName, Command, Enabled, Hidden,Caller_User_Name, EventCode
+  | lookup windows_suspicious_tasks task_name as TaskName 
+  | where isnotnull(tool_type)
+  | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_scheduled_task_with_suspicious_name_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
+known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately.
+references:
+- https://attack.mitre.org/techniques/T1053/005/
+- https://www.ic3.gov/CSA/2023/231213.pdf
+- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/
+- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv
+drilldown_searches:
+- name: View the detection results for - "$dest$" and "$user$"
+  search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$" and "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: Investigate schedule tasks on $dest$ 
+  search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND TaskName = "$TaskName$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: A windows scheduled task was created with known suspicious task name [$TaskName$] on $dest$, this may be a [$tool$] indicator
+  risk_objects: 
+  - field: dest
+    type: system
+    score: 70
+  - field: user
+    type: user
+    score: 70
+  threat_objects: 
+  - field: Command
+    type: signature
+tags:
+  analytic_story: 
+  - Scheduled Tasks
+  - Windows Persistence Techniques
+  - Ransomware
+  - Ryuk Ransomware
+  asset_type: Endpoint
+  mitre_attack_id: 
+  - T1053.005
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_with_suspect_name/windows-xml.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
@@ -1,7 +1,7 @@
 name: Windows Service Creation on Remote Endpoint
 id: e0eea4fa-4274-11ec-882b-3e22fbd008af
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-13'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -62,8 +62,11 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
-  - Active Directory Lateral Movement
+  - SnappyBee
  - CISA AA23-347A
+  - Active Directory Lateral Movement
+  - China-Nexus Threat Activity
+  - Earth Estries
  asset_type: Endpoint
  mitre_attack_id:
  - T1543.003
@@ -75,7 +78,6 @@ tags:
 tests:
 - name: True Positive Test
  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: XmlWinEventLog
@@ -1,7 +1,7 @@
 name: Windows Service Creation Using Registry Entry
 id: 25212358-948e-11ec-ad47-acde48001122
 version: '13'
-date: '2025-02-24'
+date: '2025-02-26'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
 type: Anomaly
@@ -52,16 +52,17 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
-  - China-Nexus Threat Activity
-  - Crypto Stealer
-  - Brute Ratel C4
-  - Derusbi
-  - Active Directory Lateral Movement
-  - CISA AA23-347A
+  - SnappyBee
  - Windows Persistence Techniques
+  - Brute Ratel C4
+  - CISA AA23-347A
  - Suspicious Windows Registry Activities
+  - China-Nexus Threat Activity
+  - Derusbi
  - PlugX
  - Windows Registry Abuse
+  - Active Directory Lateral Movement
+  - Crypto Stealer
  - Earth Estries
  asset_type: Endpoint
  mitre_attack_id:
@@ -0,0 +1,67 @@
+name: Windows SnappyBee Create Test Registry
+id: 80402396-d78a-4c6e-ade5-7697ea670adf
+version: 1
+date: '2025-02-11'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+description: The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for monitoring update of itself file path, updated configuration file, or system mark compromised. The detection leverages **Sysmon Event ID 13** (Registry Value Set) to identify unauthorized changes. Analysts should investigate processes associated with these modifications, particularly unsigned executables or suspicious command-line activity, as they may indicate malware or unauthorized software behavior.
+data_source:
+- Sysmon EventID 13
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Test\\*"
+  BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_snappybee_create_test_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: Administrators and third party software may create this registry entry.
+references:
+- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
+drilldown_searches:
+- name: View the detection results for - "$dest$"
+  search: '%original_detection_search% | search  dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: a Test registry Entry [$registry_path$] was created on [$dest$].
+  risk_objects:
+  - field: dest
+    type: system
+    score: 60
+  - field: user
+    type: user
+    score: 60
+  threat_objects: []
+tags:
+  analytic_story:
+  - SnappyBee
+  - China-Nexus Threat Activity
+  - Earth Estries
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/test_registry/test_reg.log
+    sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    source: XmlWinEventLog
@@ -1,7 +1,7 @@
 name: Windows Suspicious Process File Path
 id: ecddae4e-3d4b-41e2-b3df-e46a88b38521
-version: 7
-date: '2025-02-10'
+version: 8
+date: '2025-02-11'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -103,6 +103,9 @@ tags:
  - MoonPeak
  - ValleyRAT
  - Meduza Stealer
+  - China-Nexus Threat Activity
+  - Earth Estries
+  - SnappyBee
  asset_type: Endpoint
  mitre_attack_id:
  - T1543
@@ -0,0 +1,78 @@
+name: Windows Svchost.exe Parent Process Anomaly
+id: 1d38e5e9-2ff8-4c47-872c-bf1657cefab5
+version: 1
+date: '2025-02-11'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects an anomaly where an svchost.exe process is spawned by a parent process other than the standard services.exe. In a typical Windows environment, svchost.exe is a system process that hosts Windows service DLLs, and is expected to be a child of services.exe. A process deviation from this hierarchy may indicate suspicious behavior, such as malicious code attempting to masquerade as a legitimate system process or evade detection. It is essential to investigate the parent process and associated behavior for further signs of compromise or unauthorized activity.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.parent_process_name != "services.exe" AND Processes.process_name = "svchost.exe" AND Processes.process != unknown 
+  AND Processes.parent_process_path != "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe"
+  AND Processes.parent_process_path != "C:\\Program Files\\Windows Defender\\MsMpEng.exe"
+  by Processes.parent_process_name Processes.parent_process_path Processes.parent_process Processes.process_path Processes.process Processes.original_file_name Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_svchost_exe_parent_process_anomaly_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Windows Update or other Windows Installer processes may launch their own svchost.exe processes that are not directly spawned by services.exe in certain edge cases (e.g., during patches or updates).
+references:
+- https://attack.mitre.org/techniques/T1036/009/
+- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
+drilldown_searches:
+- name: View the detection results for - "$dest$"
+  search: '%original_detection_search% | search  dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: An svchost.exe process was spawned by an unexpected parent process [$parent_process_name$] instead of services.exe on [$dest$].
+  risk_objects:
+  - field: dest
+    type: system
+    score: 50
+  - field: user
+    type: user
+    score: 50
+  threat_objects:
+  - field: parent_process_name
+    type: parent_process_name
+tags:
+  analytic_story:
+  - SnappyBee
+  - China-Nexus Threat Activity
+  - Earth Estries
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1036.009
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1035.009/suspicious_spawn_svchost/susp_svchost_proc.log
+    sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    source: XmlWinEventLog
@@ -1,7 +1,7 @@
 name: Windows Unsigned DLL Side-Loading In Same Process Path
 id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f
-version: '8'
-date: '2025-02-24'
+version: 8
+date: '2025-02-26'
 author: Teoderick Contreras, Splunk
 data_source:
 - Sysmon EventID 7
@@ -15,15 +15,15 @@ description: This detection identifies unsigned DLLs loaded through DLL side-loa
  potential security breaches. Regular security assessments, thorough monitoring,
  and implementing security best practices are essential in safeguarding systems from
  such threats.
-search: '`sysmon` EventCode=7 Signed=false SignatureStatus != Valid NOT (Image IN
-  ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*"))
-  NOT (ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program
-  Files*")) |  rex field=Image "(?<ImageFolderPath>.+\\\)" |  rex field=ImageLoaded
-  "(?<ImageLoadedFolderPath>.+\\\)" |  where ImageFolderPath = ImageLoadedFolderPath
-  | stats count min(_time) as firstTime max(_time) as lastTime by Image ProcessGuid
-  ImageLoaded user Computer EventCode ImageFolderPath ImageLoadedFolderPath Company
-  Description Product Signed SignatureStatus |  rename Computer as dest | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_in_same_process_path_filter`'
+search: '`sysmon` EventCode=7 Signed=false SignatureStatus != Valid NOT (Image IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) NOT (ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*"))  ImageLoaded = *.dll
+  | rex field=Image "(?<ImageFolderPath>.+\\\)"
+  | rex field=ImageLoaded "(?<ImageLoadedFolderPath>.+\\\)"
+  | where ImageFolderPath = ImageLoadedFolderPath
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ProcessGuid ImageLoaded user Computer EventCode ImageFolderPath ImageLoadedFolderPath Company Description Product Signed SignatureStatus
+  | rename Computer as dest
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_unsigned_dll_side_loading_in_same_process_path_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name and imageloaded executions from your endpoints. If you
  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
@@ -59,6 +59,7 @@ tags:
  - DarkGate Malware
  - PlugX
  - Earth Estries
+  - SnappyBee
  asset_type: Endpoint
  mitre_attack_id:
  - T1574.002
@@ -0,0 +1,72 @@
+name: Windows Unusual SysWOW64 Process Run System32 Executable
+id: e4602172-db86-4315-86df-da66fb40bcde
+version: 1
+date: '2025-02-11'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects an unusual process execution pattern where a process running from C:\Windows\SysWOW64\ attempts to execute a binary from C:\Windows\System32\. In a typical Windows environment, 32-bit processes under SysWOW64 should primarily interact with 32-bit binaries within the same directory. However, an execution flow where a 32-bit process spawns a 64-bit binary from System32 can indicate potential process injection, privilege escalation, evasion techniques, or unauthorized execution hijacking.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_path = "*\\Windows\\SysWOW64\\*" AND Processes.process = "*windows\\system32\\*"
+  by Processes.parent_process_name Processes.process_path Processes.process Processes.original_file_name Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_unusual_syswow64_process_run_system32_executable_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: some legitimate system processes, software updaters, or compatibility tools may trigger this behavior, occurrences involving unknown, unsigned, or unusual parent processes should be investigated for potential malware activity, persistence mechanisms, or execution flow hijacking.
+references:
+- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
+drilldown_searches:
+- name: View the detection results for - "$dest$"
+  search: '%original_detection_search% | search  dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: a 32 bit process execute 64 bit executable on [$dest$].
+  risk_objects:
+  - field: dest
+    type: system
+    score: 40
+  threat_objects:
+  - field: process_path
+    type: process_name
+tags:
+  analytic_story:
+  - China-Nexus Threat Activity
+  - DarkGate Malware
+  - Earth Estries
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1036.009
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.009/32bit_process_execute_64bit/32bit_spawn_64bit.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,128 @@
+task_name,task_command,task_arguments,tool,tool_category,tool_type,link,severity,comment,reference
+,*powershell.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
+,*wscript.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
+,*cscript.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
+,*cmd.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
+,*sh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
+,*ksh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
+,*zsh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
+,*bash.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
+,*scrcons.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
+,*pwsh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
+,powershell.exe,*-Command whoami*,whoami,Discovery,greyware_tool,https://github.com/mthcht/awesome-lists,medium,N/A,https://github.com/mthcht/awesome-lists
+,powershell.exe,-encodedCommand *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,medium,base64 encoded command from a scheduled task,https://github.com/mthcht/awesome-lists
+,powershell.exe,-enc *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,medium,base64 encoded command from a scheduled task,https://github.com/mthcht/awesome-lists
+,cmd.exe,*/c whoami*,whoami,Discovery,greyware_tool,https://github.com/mthcht/awesome-lists,medium,N/A,https://github.com/mthcht/awesome-lists
+\area41,C:\_Microsoft\Microsoft.exe,,CryptInject,Malware,offensive_tool,https://github.com/roadwy/DefenderYara/blob/9bbdb7f9fd3513ce30aa69cd1d88830e3cf596ca/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_PJ_MTB.yar#L36,critical,N/A,https://github.com/mthcht/awesome-lists
+\OfficeServicesStatus,*wscript*\public\*,,ISMDoor,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/,high,N/A,https://github.com/mthcht/awesome-lists
+\Business Aviation,*wscript*,,Gootloader,Malware,offensive_tool,https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/,critical,N/A,https://github.com/mthcht/awesome-lists
+\Destination Branding,*wscript*,,Gootloader,Malware,offensive_tool,https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/,critical,N/A,https://github.com/mthcht/awesome-lists
+\InetlSecurityAssistManager,*wscript *,,OopsIE,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/,high,N/A,https://github.com/mthcht/awesome-lists
+,*wevtutil.exe,cl *,wevtutil,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,high,clearing event logs with wevtutil.exe,https://github.com/mthcht/awesome-lists
+\GoogleUpdateTaskMachineUI,*update.vbs*,,Helminth,Malware,offensive_tool,https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/,high,N/A,https://github.com/mthcht/awesome-lists
+\Wow64 Subsystem,*programdata*mswow86.exe*,,NetSupport Manager,RAT,offensive_tool,https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/,medium,N/A,https://github.com/mthcht/awesome-lists
+\copy,*powershell.exe*,*Copy-Item*\ProgramData\*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists
+\def,*powershell.exe*,*Get-MpPreference*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists
+\FJ_load,*madHcCtrl.exe*,,Danabot,Infostealer,offensive_tool,https://securelist.com/tusk-infostealers-campaign/113367/,high,N/A,https://github.com/mthcht/awesome-lists
+\shell,*Invoke-PowerShellTcpRun*,,Schtasks_latmov.bat,Lateral Movement,offensive_tool,https://github.com/S3cur3Th1sSh1t/Creds/blob/f71e780c51fdc2fdabe4e51831fa6289b1bede96/batch/Schtasks_latmov.bat#L2,critical,N/A,https://github.com/mthcht/awesome-lists
+*StageProxyOps*,*HTTP-Server.ps1*,,HTTP-Server,Persistence,offensive_tool,https://github.com/NullArray/WinBins-Plus/blob/1e4af04ceaa8085b532757a1331113e919a20f4b/Scripts/persist.cmd#L2,critical,N/A,https://github.com/mthcht/awesome-lists
+\GoogleUpdatesTaskMachineUI,*fireeye.vbs*,,Helminth,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/,high,N/A,https://github.com/mthcht/awesome-lists
+\MicrosoftEdgeUpdateTaskMachineMS,*EdgeBrowser.cmd*,,MeshAgent,RAT,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/awaken-likho-apt-new-implant-campaign_114101/content.txt#L831,high,N/A,https://github.com/mthcht/awesome-lists
+\run1,*cmd.exe*,*/c *\ProgramData\*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists
+\SecurityAssist,*Certutil*,,OopsIE,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/,high,N/A,https://github.com/mthcht/awesome-lists
+\mstask,*C:\temp\*,,Trojan.Win32.BreakWin,Malware,offensive_tool,https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/,critical,N/A,https://github.com/mthcht/awesome-lists
+\ReportHealth,*appdata*\srvHealth.exe*,,ISMInjector,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/,high,N/A,https://github.com/mthcht/awesome-lists
+,*\Windows\Debug*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the *\Windows\Debug folder,https://github.com/mthcht/awesome-lists
+\MicrosoftEdgeUpdateTaskMachineUC,*\users\public\*,,autohotkey,keylogger,offensive_tool,https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/,high,N/A,https://github.com/mthcht/awesome-lists
+,*\Users\public*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the Public user profile,https://github.com/mthcht/awesome-lists
+,*\Users*\Downloads*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the users Downloads folder,https://github.com/mthcht/awesome-lists
+,*\Users*\Documents*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the users Documents folder,https://github.com/mthcht/awesome-lists
+,*\Users*\AppData\Roaming*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the roaming folder,https://github.com/mthcht/awesome-lists
+,*\Users*\AppData\Local*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the appdata folder,https://github.com/mthcht/awesome-lists
+\SystemFailureReporter,*\public\*,,SideTwist Backdoor (APT34),Malware,offensive_tool,https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/,critical,N/A,https://github.com/mthcht/awesome-lists
+,*\ProgramData*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the ProgramData folder,https://github.com/mthcht/awesome-lists
+\MEGA\MEGAsync Update Task*,*\MEGAupdater.exe,,MEGASync,Data Exfiltration,greyware_tool,https://mega.io/en/desktop,high,N/A,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/MEGAsync.csv
+\WallPaperChangeApp,*\Autoit3\Autoit3.exe*,,OxtaRAT,Malware,offensive_tool,https://research.checkpoint.com/2023/operation-silent-watch-desktop-surveillance-in-azerbaijan-and-armenia/,critical,N/A,https://github.com/mthcht/awesome-lists
+,*\AppData\Local\Temp\*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,high,task in the temp folder,https://github.com/mthcht/awesome-lists
+\Microsoft_Auto_Scheduler,*\AppData\*,,Kube Ransomware,Ransomware,offensive_tool,https://x.com/ShanHolo/status/1880566701009563915/photo/1,high,N/A,https://github.com/mthcht/awesome-lists
+,*:\Windows\Temp\*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,executable from the temp folder,https://github.com/mthcht/awesome-lists
+,*:\windows\system32\calc.exe,,POC,exploitation,greyware_tool,https://x.com/hackingforbeer/status/1719402854085951883,medium,POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe',https://github.com/mthcht/awesome-lists
+"\tMicNet Work40,",*.vbs*,,AsyncRAT,Malware,offensive_tool,https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/,critical,AsyncRATâ€™s Infection samples,https://github.com/mthcht/awesome-lists
+\yastcat,,,Wannamine,Cryptominer,offensive_tool,crowdstrike.com/blog/cryptomining-harmless-nuisance-disruptive-threat/,critical,Moonero miner - command SCHTASKS /create /RU System /SC DAILY /TN yastcat /f /TR %temp%\y1.bat &&SCHTASKS /run /TN yastcat,https://github.com/mthcht/awesome-lists
+\OneNote 4726,,,Unkown,Malware,offensive_tool,https://x.com/Gi7w0rm/status/1864307803914981837,medium,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll,,,Trojan.Win32.BreakWin,Malware,offensive_tool,https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/,critical,N/A,https://github.com/mthcht/awesome-lists
+\dongs,,,suspicious names,exploitation,offensive_tool,https://x.com/hackingforbeer/status/1719402854085951883,medium,POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe',https://github.com/mthcht/awesome-lists
+\StopVMMSandKillVMWP,,,StopVMMSandKillVMWP script,Defense evasion,offensive_tool,https://x.com/GroupIB_DFIR/status/1750452267692728516,high,schtasks /create /tn StopVMMSandKillVMWP /tr 'powershell.exe -Command get-service -name vmms | stop-service -force ; taskkill /f /im vmwp.exe' /sc minute /mo 30 /ru SYSTEM /f,https://github.com/mthcht/awesome-lists
+\SSH Key Exchange,,,sshd,Persistence,greyware_tool,https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/,medium,compliance,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv
+\SSH Server,,,sshd,Persistence,greyware_tool,https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/,medium,compliance,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv
+\MeterpeterC2,,,redpill,exploitation,offensive_tool,https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/bin/SchTasks.ps1#L83,critical,SchTasks.ps1,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv
+\RedPillTask,,,redpill,exploitation,offensive_tool,https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/redpill.ps1#L743,critical,redpill.ps1,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv
+\SQLC2AgentPS*,,,PowerUpSQL,C2,offensive_tool,https://github.com/NetSPI/PowerUpSQL/blob/a83cad211983290bf38708e6e237cacbfe023e32/scripts/pending/SQLC2.ps1#L958,critical,N/A,https://github.com/mthcht/awesome-lists
+My Startup Task,,,Powershell-Scripts-for-Hackers-and-Pentesters,Persistence,offensive_tool,https://github.com/Whitecat18/Powershell-Scripts-for-Hackers-and-Pentesters/blob/788e89e9584b4b43f982721d59c06c77c0b3b566/PS-020.md?plain=1#L20,medium,N/A,https://github.com/mthcht/awesome-lists
+,,*Set-MpPreference -DisableRealtimeMonitoring *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,high,disabling Defender Real time monitoring,https://github.com/mthcht/awesome-lists
+\OneDrive Security,,,Nitrogen,Malware,offensive_tool,https://news.sophos.com/en-us/2023/07/26/into-the-tank-with-nitrogen/,high,N/A,https://github.com/mthcht/awesome-lists
+\Demovale,,,Nightdoor,Malware,offensive_tool,lhttps://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/www_welivesecurity_com/en_eset-research_evasive-panda-leverages-monlam-festival-target-tibetans/content.txt#L269C143-L269C152,high,N/A,https://github.com/mthcht/awesome-lists
+\8766714F94DD,,,more_eggs,Malware,offensive_tool,https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/n=,high,N/A,https://github.com/mthcht/awesome-lists
+\Loki,,,LokiLocker,Ransomware,offensive_tool,https://blogs.blackberry.com/en/2022/03/lokilocker-ransomware,critical,command observed schtasks /CREATE /SC ONLOGON /TN Loki /TR *,https://github.com/mthcht/awesome-lists
+\LimeRAT-Admin,,,Lime-RAT,Malware,offensive_tool,https://github.com/NYAN-x-CAT/Lime-RAT/blob/87e189781c0aef0e84cabe2f8c2e7d8f5143e594/Project/Client/C_Installation.vb#L76,critical,N/A,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/Lime-RAT.csv
+\NFUBffk,,,LemonDuck,Malware,offensive_tool,https://notes.netbytesec.com/2024/10/lemonduck-unleashes-cryptomining.html,high,N/A,https://github.com/mthcht/awesome-lists
+\K0adic,,,koadic,C2,offensive_tool,https://github.com/Averroes/koadic/blob/97886ed570f31efff09d1e06c4a7ece2d9b6bd27/data/implant/persist/schtasks.js#L4C21-L4C27,critical,N/A,https://github.com/mthcht/awesome-lists
+\Feedback_API_VS_Services_Client,,,Keyzetsu clipper variant,Malware,offensive_tool,https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/,medium,N/A,https://github.com/mthcht/awesome-lists
+\Tater,,,Invoke-Tater,Privilege Escalation,offensive_tool,https://github.com/BC-SECURITY/Empire/blob/8aca42747da6cf2b0def7edede94586f6b3258e8/empire/server/data/module_source/privesc/Invoke-Tater.ps1#L101,critical,PowerShell implementation of the Hot Potato Windows Privilege Escalation exploit from @breenmachine and @foxglovesec,https://github.com/mthcht/awesome-lists
+\\Defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\DefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCkeck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\ATPUpd,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\Data Integrity Scan\Data Integrity Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\DefenderUPDService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\IISUpdateService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\Speech\\SpeechModelInstallTask,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\WiMSDFS,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\Windows Defender\\Defender Update Service,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\Windows Defender\\Service Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\Windows Error Reporting\\CheckReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\Windows Error Reporting\\SubmitReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\Windows Filtering Platform\\BfeOnServiceStart,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\WindowsDefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\WindowsDefenderService2,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\WindowsUpdate\\Scheduled AutoCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Check,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\\WindowUpdate,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\DefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\Application Experience\StartupAppTaskCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\Application Experience\StartupAppTaskCkeck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\ATPUpd,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\Data Integrity Scan\Data Integrity Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\DefenderUPDService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\IISUpdateService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\Speech\SpeechModelInstallTask,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\WiMSDFS,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\Windows Defender\Defender Update Service,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\Windows Defender\Service Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\Windows Error Reporting\CheckReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\Windows Error Reporting\SubmitReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\WindowsDefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\WindowsDefenderService2,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\Microsoft\Windows\WindowsUpdate\Scheduled Check,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\WindowUpdate,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
+\InfrSiRfucture Technologies,,,Gootloader,Malware,offensive_tool,https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/,critical,N/A,https://github.com/mthcht/awesome-lists
+\SynchronizeTimeZone,,,frp,Data Exfiltration,offensive_tool,https://www.aha.org/system/files/media/file/2021/05/fbi-flash-tlp-white-apt-actors-exploiting-fortinet-vulnerabilities-to-gain-access-for-malicious-activity-5-27-21.pdf,high,APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity - creating specific scheduled task for exfiltration,https://github.com/mthcht/awesome-lists
+\CursorSvc,,,Fentanyl Stealer,Malware,offensive_tool,https://github.com/dekrypted/Fentanyl/blob/2b4a008934f21df4eed7b90fb3019d3395f7c909/fenty.py#L699C53-L699C62,critical,Similar to Bandit Stealer,https://github.com/mthcht/awesome-lists
+\DisableBitdefender-*,,,Dispossesor,Ransomware,offensive_tool,https://vx-underground.org/Archive/Dispossessor%20Leaks,high,N/A,https://github.com/mthcht/awesome-lists
+\DHARMA,,,Dharma,Ransomware,offensive_tool,https://www.joesandbox.com/analysis/860608/0/lighthtml,critical,command observed schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe*,https://github.com/mthcht/awesome-lists
+\Sorry,,,Cryptominer,Cryptominer,offensive_tool,https://x.com/cglyer/status/1001463072672886785,high,schtasks /create /tn 'Sorry' /tr C:\Windows\Temp\taskhost.exe /sc daily /mo 2 /st 22:00:00 /f4,https://x.com/cglyer/status/1001463072672886785
+\shadowdev,,,CobaltStrike,C2,offensive_tool,https://cloud.google.com/blog/topics/threat-intelligence/melting-unc2198-icedid-to-ransomware-operations,critical,cmd.exe /c schtasks /create /sc minute /mo 1 /tn shadowdev /tr C:\\ProgramData\\S\u0443sH\u0435\u0430ls\\T\u0430s\u0441host.exe,https://github.com/mthcht/awesome-lists
+\ClearEventLogs,,,Cleareventlog script,Defense Evasion,offensive_tool,https://x.com/GroupIB_DFIR/status/1750452304606810175,high,schtasks /create /tn ClearEventLogs /tr 'powershell.exe -Command wevtutil el | foreach { wevtutil cl $_ }' /sc daily /st 03:00 /ru SYSTEM /f,https://github.com/mthcht/awesome-lists
+\SC Scheduled Scan,,,Chafer,Malware,offensive_tool,https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/,high,Chafer activity attributed to OilRig,https://github.com/mthcht/awesome-lists
+\UpdatMachine,,,Chafer,Malware,offensive_tool,https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/,high,Chafer activity attributed to OilRig,https://github.com/mthcht/awesome-lists
+\drogon,,,BadRabbit,Malware,offensive_tool,https://www.vmray.com/analyses/bad-rabbit-ransomware-flash-analysis/report/overview.html,critical,schtasks /Create /SC once /TN drogon /RU SYSTEM /TR 'C:\Windows\system32\shutdown.exe /r /t 0 /f' /ST 02:34:00,https://github.com/mthcht/awesome-lists
+\BaiduUpdateTask1,,,BADNEWS,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/,high,N/A,https://github.com/mthcht/awesome-lists
+\AutoRDPwn,,,AutoRDPwn,C2,offensive_tool,https://github.com/JoelGMSec/AutoRDPwn/blob/839d6afbd2cfa64b01a188b4e09a3e079c9c81d3/AutoRDPwn.ps1#L678,critical,N/A,https://github.com/mthcht/awesome-lists
+\thepiratMicrosoftEdgeUpdateTask,,,AsyncRAT,Malware,offensive_tool,https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/,critical,AsyncRATâ€™s Infection samples,https://github.com/mthcht/awesome-lists
+\kbnvmmmhjo,,,Agent Tesla,Malware,offensive_tool,https://isc.sans.edu/diary/PowerPoint+attachments+Agent+Tesla+and+code+reuse+in+malware/28154,critical,N/A,https://github.com/mthcht/awesome-lists
@@ -0,0 +1,15 @@
+name: windows_suspicious_tasks
+date: 2025-02-07
+version: 1
+id: 928cba69-be80-4601-9b0d-3ec81f714338
+author: Steven Dick
+lookup_type: csv
+description: A list of suspicious Windows Scheduled Task names and locations
+default_match: false
+match_type: 
+- WILDCARD(task_name)
+- WILDCARD(task_command)
+- WILDCARD(task_arguments)
+min_matches: 1
+max_matches: 1
+case_sensitive_match: false
@@ -0,0 +1,20 @@
+name: SnappyBee
+id: 99f066e0-2492-45ed-acb4-a42abbd585fd
+version: 1
+date: '2025-02-07'
+author: Teoderick Contreras, Splunk
+status: production
+description: SnappyBee is a stealthy malware variant designed to exfiltrate sensitive data while evading traditional security measures. It primarily spreads through phishing emails, malicious attachments, and drive-by downloads. Once executed, SnappyBee establishes persistence by modifying system registries and injecting malicious code into legitimate processes. It employs advanced obfuscation techniques to avoid detection, including polymorphic encryption and sandbox evasion. The malware actively monitors user activities, capturing credentials, keystrokes, and network traffic before transmitting the stolen data to a remote command-and-control (C2) server. This analytic story is designed to detect possible mitre attack tatics and technique related to SnappyBee malware.
+narrative: SnappyBee emerged as a highly evasive malware designed for data theft and espionage. Initially spotted in targeted phishing campaigns, it quickly gained notoriety for its stealth and adaptability. Cybersecurity researchers found that SnappyBee disguises itself as legitimate software, infecting systems through malicious email attachments, compromised websites, and software cracks. Once activated, it burrows deep into the system, modifying registries and injecting code into trusted processes to remain undetected. Advanced evasion techniques, such as polymorphic encryption and sandbox detection, make traditional signature-based security ineffective. SnappyBee’s primary goal is to steal credentials, keystrokes, and network data, transmitting them to remote attackers. Continuous monitoring and proactive threat intelligence remain crucial to counter this evolving cyber menace.
+references:
+- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
+tags:
+  category:
+  - Data Destruction
+  - Malware
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection