Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2022-10-18 13:57:24 -07:00
parent 2e1c861307 e1e1bf879b
commit 9e26f53df4
16 changed files with 1135 additions and 167 deletions
@@ -5,7 +5,7 @@
    "id": {
      "group": null, 
      "name": "DA-ESS-ContentUpdate", 
-      "version": "3.50.0"
+      "version": "3.51.0"
    }, 
    "author": [
      {
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-14T19:00:36 UTC
+# On Date: 2022-10-18T20:46:45 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -187,6 +187,16 @@ annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = 
 providing_technologies = null

+[savedsearch://ESCU - AWS Console Login Failed During MFA Challenge - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = The following analytic identifies an authentication attempt event against an AWS Console that fails during the Multi Factor Authentication challenge. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled.
+how_to_implement = The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+known_false_positives = Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
 [savedsearch://ESCU - AWS Create Policy Version to allow all resources - Rule]
 type = detection
 asset_type = AWS Account
@@ -457,6 +467,26 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
 providing_technologies = ["Amazon Web Services - Cloudtrail"]

+[savedsearch://ESCU - AWS Multi-Factor Authentication Disabled - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = The following analytic identifies an attempt to disable multi-factor authentication for an AWS IAM user. An adversary who has obtained access to an AWS tenant may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account. This way the attackers can keep persistance in the environment without adding new users.
+how_to_implement = The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+known_false_positives = AWS Administrators may disable MFA but it is highly unlikely for this event to occur without prior notice to the company
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
+[savedsearch://ESCU - AWS Multiple Failed MFA Requests For User - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = The following analytic identifies multiple failed multi-factor authentication requests to an AWS Console for a single user. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. AWS Environments can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
+how_to_implement = The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+known_false_positives = Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
 [savedsearch://ESCU - AWS Multiple Users Failing To Authenticate From Ip - Rule]
 type = detection
 asset_type = AWS Account
@@ -517,6 +547,16 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
 providing_technologies = ["Amazon Web Services - Cloudtrail"]

+[savedsearch://ESCU - AWS Successful Single-Factor Authentication - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = The following analytic identifies a successful Console Login authentication event against an AWS IAM user for an account without Multi-Factor Authentication enabled. This could be evidence of a misconfiguration, a policy violation or an account take over attempt that should be investigated
+how_to_implement = The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078.004"], "nist": ["DE.CM"]}
+known_false_positives = It is possible that some accounts do not have MFA enabled for the AWS account however its agaisnt the best practices of securing AWS.
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
 [savedsearch://ESCU - AWS Unusual Number of Failed Authentications From Ip - Rule]
 type = detection
 asset_type = AWS Account
@@ -2767,7 +2807,7 @@ providing_technologies = null
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.
+explanation = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell and ProxyNotShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003", "T1190"]}
 known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
@@ -3807,6 +3847,20 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00
 known_false_positives = Unknown. Filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Exchange PowerShell Module Usage - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Adversaries may abuse a limited set of PwSh Modules related to Exchange once gained access via ProxyShell or ProxyNotShell.\
+Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \
+Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \
+Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG). \
+Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \ Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059", "T1059.001"]}
+known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
+providing_technologies = ["Microsoft Windows"]
+
 [savedsearch://ESCU - Executable File Written in Administrative SMB Share - Rule]
 type = detection
 asset_type = Endpoint
@@ -7949,6 +8003,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Ins
 known_false_positives = It is possible third party applications may add these SPNs to Computer Accounts, filtering may be needed.
 providing_technologies = ["Microsoft Windows"]

+[savedsearch://ESCU - Windows Create Local Account - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a new local user account added to a computer. Note that, this should be restricted to critical assets.
+how_to_implement = This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs.  More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["DE.CM"]}
+known_false_positives = It is possible that an administrator created the account. Verifying activity with an administrator is advised. This analytic is set to anomaly to allow for risk to be added. Filter and tune as needed. Restrict to critical infrastructure to reduce any volume.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Curl Download to Suspicious Path - Rule]
 type = detection
 asset_type = Endpoint
@@ -8678,6 +8742,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or f
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Windows Mshta Execution In Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the usage of mshta.exe Windows binary in registry to execute malicious script. This technique was seen in kovter malware where it create several registry entry which is a encoded javascript and will be executed by another registry containing mshta and javascript activexobject to execute the encoded script using wscript.shell. This TTP is a good indication of kovter malware or other adversaries or threat actors leveraging fileless detection that survive system reboot.
+how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows MSIExec DLLRegisterServer - Rule]
 type = detection
 asset_type = Endpoint
@@ -9998,7 +10072,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic identifies suspicious behavior related to ProxyShell against on-premise Microsoft Exchange servers. \
+explanation = This analytic identifies suspicious behavior related to ProxyShell against on-premise Microsoft Exchange servers. This analytic has been replaced by GUID d436f9e7-0ee7-4a47-864b-6dea2c4e2752 which utilizes the Web Datamodel. \
 Modification of this analytic is requried to ensure fields are mapped accordingly. \
 A suspicious event will have `PowerShell`, the method `POST` and `autodiscover.json`. This is indicative of accessing PowerShell on the back end of Exchange with SSRF. \
 An event will look similar to `POST /autodiscover/autodiscover.json a=dsxvu@fnsso.flq/powershell/?X-Rps-CAT=VgEAVAdXaW5kb3d...` (abbreviated) \
@@ -10008,20 +10082,6 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 known_false_positives = Limited false positives, however, tune as needed.
 providing_technologies = null

-[savedsearch://ESCU - Exchange PowerShell Module Usage - Rule]
-type = detection
-asset_type = Endpoint
-confidence = medium
-explanation = The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Currently, there is no active data shared or data we could re-produce relate to this part of the ProxyShell chain of exploits.  \
-Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \
-Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \
-Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG). \
-Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \ Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).
-how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-annotations = {"kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059", "T1059.001"]}
-known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = ["Microsoft Windows"]
-
 [savedsearch://ESCU - First Time Seen Child Process of Zoom - Rule]
 type = detection
 asset_type = Endpoint
@@ -10293,7 +10353,7 @@ type = detection
 asset_type = Endpoint
 confidence = medium
 explanation = The following analytic uses a pretrained deep learning model to detect Domain Generation Algorithm (DGA) generated domains. The model is trained independently and is then made available for download. One of the prominent indicators of a domain being DGA generated is if the domain name consists of unusual character sequences or concatenated dictionary words. Adversaries often use clever techniques to obfuscate machine generated domain names as human generated. Predicting DGA generated domain names requires analysis and building a model based on carefully chosen features. The deep learning model we have developed uses the domain name to anlayze patterns of character sequences along with carefully chosen custom features to predict if a domain is DGA generated. The model takes a domain name consisting of second-level and top-level domain names as input and outputs a dga_score. Higher the dga_score, the more likely the input domain is a DGA domain. The threshold for flagging a domain as DGA is set at 0.5.
-how_to_implement =  * Steps to deploy DGA detection model into Splunk App DSDL. This detection depends on the Splunk app for Data Science and Deep Learning which can be found here - https://splunkbase.splunk.com/app/4607/ and the Network Resolution datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. The detection uses a pre-trained deep learning model that needs to be deployed in DSDL app. Follow the steps for deployment here - https://github.com/splunk/security_content/wiki/How-to-deploy-Deep-Learning-models-for-ESCU. * Download the artifacts .tar.gz file from the link - https://seal.splunkresearch.com/pretrained_dga_model_dsdl.tar.gz * Download the pretrained_dga_model_dsdl.ipynb Jupyter notebook from https://github.com/splunk/security_content/notebooks * Login to the Jupyter Lab for pretrained_dga_model_dsdl container. This container should be listed on Containers page for DSDL app. * Below steps need to be followed inside Jupyter lab * Upload the pretrained_dga_model_dsdl.tar.gz file into app/model/data path using the upload option in the jupyter notebook. * Untar the artifact pretrained_dga_model_dsdl.tar.gz using tar -xf app/model/data/pretrained_dga_model_dsdl.tar.gz -C app/model/data * Upload pretrained_dga_model_dsdl.pynb into Jupyter lab notebooks folder using the upload option in Jupyter lab * Save the notebook using the save option in jupyter notebook. * Upload pretrained_dga_model_dsdl.json into notebooks/data folder.
+how_to_implement =  * Steps to deploy DGA detection model into Splunk App DSDL. This detection depends on the Splunk app for Data Science and Deep Learning which can be found here - https://splunkbase.splunk.com/app/4607/ and the Network Resolution datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. The detection uses a pre-trained deep learning model that needs to be deployed in DSDL app. Follow the steps for deployment here - https://github.com/splunk/security_content/wiki/How-to-deploy-pre-trained-Deep-Learning-models-for-ESCU. * Download the artifacts .tar.gz file from the link - https://seal.splunkresearch.com/pretrained_dga_model_dsdl.tar.gz * Download the pretrained_dga_model_dsdl.ipynb Jupyter notebook from https://github.com/splunk/security_content/notebooks * Login to the Jupyter Lab for pretrained_dga_model_dsdl container. This container should be listed on Containers page for DSDL app. * Below steps need to be followed inside Jupyter lab * Upload the pretrained_dga_model_dsdl.tar.gz file into app/model/data path using the upload option in the jupyter notebook. * Untar the artifact pretrained_dga_model_dsdl.tar.gz using tar -xf app/model/data/pretrained_dga_model_dsdl.tar.gz -C app/model/data * Upload pretrained_dga_model_dsdl.pynb into Jupyter lab notebooks folder using the upload option in Jupyter lab * Save the notebook using the save option in jupyter notebook. * Upload pretrained_dga_model_dsdl.json into notebooks/data folder.
 annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1568.002"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
 known_false_positives = False positives may be present if domain name is similar to dga generated domains.
 providing_technologies = null
@@ -10723,6 +10783,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = If there is a vulnerablility scannner looking for log4shells this will trigger, otherwise likely to have low false positives.
 providing_technologies = null

+[savedsearch://ESCU - ProxyShell ProxyNotShell Behavior Detected - Rule]
+type = detection
+asset_type = Web Server
+confidence = medium
+explanation = The following correlation will identify activity related to Windows Exchange being actively exploited by adversaries related to ProxyShell or ProxyNotShell. In addition, the analytic correlates post-exploitation Cobalt Strike analytic story. Common post-exploitation behavior has been seen in the wild includes adversaries running nltest, Cobalt Strike, Mimikatz and adding a new user. The correlation specifically looks for 5 distict analyticstories to trigger, modify or tune as needed for your organization. 5 analytic stories is an arbitrary number but was chosen to reduce the amount of noise but also require the 3 analytic stories to fire. Adversaries will exploit the vulnerable Exchange server, abuse SSRF, drop a web shell, utilize the PowerShell Exchange modules and begin post-exploitation.
+how_to_implement = To implement this correlation, you will need to enable ProxyShell, ProxyNotShell and Cobalt Strike analytic stories (the anaytics themselves) and ensure proper data is being collected for Web and Endpoint datamodels. Run the correlation rule seperately to validate it is not triggering too much or generating incorrectly. Validate by running ProxyShell POC code and Cobalt Strike behavior.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+known_false_positives = False positives will be limited, however tune or modify the query as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Spring4Shell Payload URL Request - Rule]
 type = detection
 asset_type = Web Server
@@ -10783,6 +10853,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers.
 providing_technologies = null

+[savedsearch://ESCU - Windows Exchange Autodiscover SSRF Abuse - Rule]
+type = detection
+asset_type = Web server
+confidence = medium
+explanation = The following analytic utilizes the Web datamodel and identifies the ProxyShell or ProxyNotShell abuse. This vulnerability is a Server Side Request Forgery (SSRF) vulnerability, which is a web vulnerability that allows an adversary to exploit vulnerable functionality to access server side or local network services by affectively traversing the external firewall using vulnerable web functionality. This analytic looks for the URI path and query of autodiscover, powershell and mapi along with a POST occurring. It will tally a simple score and show the output of the events that match. This analytic may be added to by simply creating a new eval statement and modifying the hardcode digit for Score.
+how_to_implement = To successfully implement this search you need to be ingesting information on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. In addition, confirm the latest CIM App 4.20 or higher is installed.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+known_false_positives = False positives are limited.
+providing_technologies = null
+
 ### END DETECTIONS ###

 ### STORIES ###
@@ -10960,7 +11040,7 @@ version = 2
 references = ["https://attack.mitre.org/tactics/TA0006/"]
 maintainers = [{"company": "Bhavin Patel,  Splunk", "email": "-", "name": "Gowthamaraj Rajendran"}]
 spec_version = 3
-searches = ["ESCU - AWS Credential Access Failed Login - Rule", "ESCU - AWS Credential Access GetPasswordData - Rule", "ESCU - AWS Credential Access RDS Password reset - Rule", "ESCU - AWS Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - AWS Unusual Number of Failed Authentications From Ip - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"]
+searches = ["ESCU - AWS Console Login Failed During MFA Challenge - Rule", "ESCU - AWS Credential Access Failed Login - Rule", "ESCU - AWS Credential Access GetPasswordData - Rule", "ESCU - AWS Credential Access RDS Password reset - Rule", "ESCU - AWS Multi-Factor Authentication Disabled - Rule", "ESCU - AWS Multiple Failed MFA Requests For User - Rule", "ESCU - AWS Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - AWS Successful Single-Factor Authentication - Rule", "ESCU - AWS Unusual Number of Failed Authentications From Ip - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"]
 description = Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS.
 narrative = Amazon Web Services provides a web service known as Identity and Access Management(IAM) for controlling and securly managing various AWS resources. This is basically the foundation of how users in AWS interact with various resources/services in cloud and vice versa. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys and takeover legitmate user accounts. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve multiple failed login to the console, new console logins and password reset activities.

@@ -11108,10 +11188,21 @@ version = 1
 references = ["https://www.cisa.gov/uscert/ncas/alerts/aa22-264a", "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-264a-iranian-cyber-actors-conduct-cyber-operations-against-the-government-of-albania.pdf", "https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against", "https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Possible Credential Dumping - Rule", "ESCU - Windows Raw Access To Disk Volume Partition - Rule", "ESCU - Windows Raw Access To Master Boot Record Drive - Rule", "ESCU - Windows System File on Disk - Rule", "ESCU - Exchange PowerShell Module Usage - Rule"]
+searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Possible Credential Dumping - Rule", "ESCU - Windows Raw Access To Disk Volume Partition - Rule", "ESCU - Windows Raw Access To Master Boot Record Drive - Rule", "ESCU - Windows System File on Disk - Rule"]
 description = Iranian State Actors Conduct Cyber Operations Against the Government of Albania.
 narrative = The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory to provide information on recent cyber operations against the Government of Albania in July and September. This advisory provides a timeline of activity observed, from initial access to execution of encryption and wiper attacks. Additional information concerning files used by the actors during their exploitation of and cyber attack against the victim organization is provided in Appendices A and B. In September 2022, Iranian cyber actors launched another wave of cyber attacks against the Government of Albania, using similar TTPs and malware as the cyber attacks in July. These were likely done in retaliation for public attribution of the cyber attacks in July and severed diplomatic ties between Albania and Iran.

+[analytic_story://CISA AA22-277A]
+category = Adversary Tactics
+last_updated = 2022-10-05
+version = 1
+references = ["https://www.cisa.gov/uscert/ncas/alerts/aa22-277a", "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-277a-impacket-and-exfiltration-tool-used-to-steal-sensitive-information-from-defense-industrial-base-organization.pdf"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Network Discovery Using Route Windows App - Rule"]
+description = From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to advanced persistent threat (APT) activity on a Defense Industrial Base (DIB) Sector organization's enterprise network. During incident response activities, multiple utilities were utilized.
+narrative = CISA uncovered that likely multiple APT groups compromised the organization's network, and some APT actors had long-term access to the environment. APT actors used an open-source toolkit called Impacket to gain their foothold within the environment and further compromise the network, and also used a custom data exfiltration tool, CovalentStealer, to steal the victim's sensitive data.
+
 [analytic_story://Cloud Cryptomining]
 category = Cloud Security
 last_updated = 2019-10-02
@@ -12046,6 +12137,17 @@ searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ES
 description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
 narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts.

+[analytic_story://ProxyNotShell]
+category = Adversary Tactics
+last_updated = 2022-09-30
+version = 1
+references = ["https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/", "https://twitter.com/GossiTheDog/status/1575762721353916417?s=20\u0026t=67gq9xCWuyPm1VEm8ydfyA", "https://twitter.com/cglyer/status/1575793769814728705?s=20\u0026t=67gq9xCWuyPm1VEm8ydfyA", "https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html", "https://research.splunk.com/stories/proxyshell/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Exchange PowerShell Abuse via SSRF - Rule", "ESCU - ProxyShell ProxyNotShell Behavior Detected - Rule", "ESCU - Windows Exchange Autodiscover SSRF Abuse - Rule"]
+description = Two new zero day Microsoft Exchange vulnerabilities have been identified actively exploited in the wild - CVE-2022-41040 and CVE-2022-41082.
+narrative = Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, 2016, and 2019. The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker. Originally identified by GTSC monitoring Exchange, some adversary post-exploitation activity was identified and is tagged to this story.
+
 [analytic_story://ProxyShell]
 category = Adversary Tactics
 last_updated = 2021-08-24
@@ -12053,7 +12155,7 @@ version = 1
 references = ["https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/", "https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell", "https://www.youtube.com/watch?v=FC6iHw258RI", "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do", "https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf"]
 maintainers = [{"company": "Teoderick Contreras, Mauricio Velazco, Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Detect Exchange Web Shell - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Exchange PowerShell Abuse via SSRF - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule"]
+searches = ["ESCU - Detect Exchange Web Shell - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Exchange PowerShell Abuse via SSRF - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - ProxyShell ProxyNotShell Behavior Detected - Rule", "ESCU - Windows Exchange Autodiscover SSRF Abuse - Rule"]
 description = ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server - CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.
 narrative = During Pwn2Own April 2021, a security researcher demonstrated an attack  chain targeting on-premise Microsoft Exchange Server. August 5th, the same researcher  publicly released further details and demonstrated the attack chain. CVE-2021-34473  Pre-auth path confusion leads to ACL Bypass (Patched in April by KB5001779)  CVE-2021-34523 - Elevation of privilege on Exchange PowerShell backend (Patched in April by KB5001779) . CVE-2021-31207 - Post-auth Arbitrary-File-Write  leads to RCE (Patched in May by KB5003435) Upon successful exploitation,  the remote attacker will have SYSTEM privileges on the Exchange Server. In addition    to remote access/execution, the adversary may be able to run Exchange PowerShell  Cmdlets to perform further actions.

@@ -12480,7 +12582,7 @@ version = 1
 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Windows Mshta Execution In Registry - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.
 narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\
 The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\
@@ -12680,7 +12782,7 @@ version = 2
 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Event Triggered Image File Execution Options Injection - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Event Triggered Image File Execution Options Injection - Rule", "ESCU - Windows Mshta Execution In Registry - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
 narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 10432
+build = 10578

 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple

 [launcher]
 author = Splunk
-version = 3.50.0
+version = 3.51.0
 description = Explore the Analytic Stories included with ES Content Updates.

 [ui]
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-14T19:00:36 UTC
+# On Date: 2022-10-18T20:46:45 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.50.0
+version = 3.51.0
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-14T19:00:36 UTC
+# On Date: 2022-10-18T20:46:45 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-14T19:00:36 UTC
+# On Date: 2022-10-18T20:46:45 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -77,6 +77,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[aws_console_login_failed_during_mfa_challenge_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [aws_create_policy_version_to_allow_all_resources_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -185,6 +189,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[aws_multi_factor_authentication_disabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_multiple_failed_mfa_requests_for_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [aws_multiple_users_failing_to_authenticate_from_ip_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -209,6 +221,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[aws_successful_single_factor_authentication_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [aws_unusual_number_of_failed_authentications_from_ip_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1497,6 +1513,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[exchange_powershell_module_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [executable_file_written_in_administrative_smb_share_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3121,6 +3141,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_create_local_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_curl_download_to_suspicious_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3401,6 +3425,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_mshta_execution_in_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_msiexec_dllregisterserver_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3921,10 +3949,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

-[exchange_powershell_module_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [first_time_seen_child_process_of_zoom_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4193,6 +4217,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[proxyshell_proxynotshell_behavior_detected_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [spring4shell_payload_url_request_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4217,6 +4245,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_exchange_autodiscover_ssrf_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+

 [aws_cloudwatchlogs_eks]
 definition = sourcetype="aws:cloudwatchlogs:eks"
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-14T19:00:36 UTC
+# On Date: 2022-10-18T20:46:45 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -757,6 +757,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls - expected_upper_threshold | table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`

+[ESCU - AWS Console Login Failed During MFA Challenge - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies an authentication attempt event against an AWS Console that fails during the Multi Factor Authentication challenge. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies an authentication attempt event against an AWS Console that fails during the Multi Factor Authentication challenge. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled.
+action.escu.how_to_implement = The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
+action.escu.known_false_positives = Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
+action.escu.creation_date = 2022-10-03
+action.escu.modification_date = 2022-10-03
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - AWS Console Login Failed During MFA Challenge - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
+action.escu.analytic_story = ["AWS Identity and Access Management Account Takeover"]
+action.risk = 1
+action.risk.param._risk_message = User $user_name$ failed to pass MFA challenge while logging into console from $src$
+action.risk.param._risk = [{"risk_object_field": "user_name", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 64}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - AWS Console Login Failed During MFA Challenge - Rule
+action.correlationsearch.annotations = {"analytic_story": ["AWS Identity and Access Management Account Takeover"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Cloud Data", "Outcome:Blocked", "Stage:Recon", "Other:Brute Force"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"], "observable": [{"name": "user_name", "role": ["Victim"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies an authentication attempt event against an AWS Console that fails during the Multi Factor Authentication challenge. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled.
+action.notable.param.rule_title = AWS Console Login Failed During MFA Challenge
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` eventName= ConsoleLogin errorMessage="Failed authentication" additionalEventData.MFAUsed = "Yes" | stats count min(_time) as firstTime max(_time) as lastTime by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion user_name userIdentity.arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_console_login_failed_during_mfa_challenge_filter`
+
 [ESCU - AWS Create Policy Version to allow all resources - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -1909,6 +1955,92 @@ realtime_schedule = 0
 is_visible = false
 search = `cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode*  errorCode = success  user_type=IAMUser | stats  count min(_time) as firstTime max(_time) as lastTime  values(requestParameters.functionName) as function_updated by src_ip user_arn user_agent user_type eventName aws_account_id |`aws_lambda_updatefunctioncode_filter`

+[ESCU - AWS Multi-Factor Authentication Disabled - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies an attempt to disable multi-factor authentication for an AWS IAM user. An adversary who has obtained access to an AWS tenant may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account. This way the attackers can keep persistance in the environment without adding new users.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies an attempt to disable multi-factor authentication for an AWS IAM user. An adversary who has obtained access to an AWS tenant may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account. This way the attackers can keep persistance in the environment without adding new users.
+action.escu.how_to_implement = The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
+action.escu.known_false_positives = AWS Administrators may disable MFA but it is highly unlikely for this event to occur without prior notice to the company
+action.escu.creation_date = 2022-10-04
+action.escu.modification_date = 2022-10-04
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - AWS Multi-Factor Authentication Disabled - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
+action.escu.analytic_story = ["AWS Identity and Access Management Account Takeover"]
+action.risk = 1
+action.risk.param._risk_message = User $user_name$ has disabled Multi-Factor authentication for AWS account $aws_account_id$
+action.risk.param._risk = [{"threat_object_field": "aws_account_id", "threat_object_type": "other"}, {"risk_object_field": "user_name", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 64}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - AWS Multi-Factor Authentication Disabled - Rule
+action.correlationsearch.annotations = {"analytic_story": ["AWS Identity and Access Management Account Takeover"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Cloud Data", "Outcome:Blocked", "Stage:Recon", "Other:Brute Force"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"], "observable": [{"name": "aws_account_id", "role": ["Victim"], "type": "Other"}, {"name": "user_name", "role": ["Victim"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies an attempt to disable multi-factor authentication for an AWS IAM user. An adversary who has obtained access to an AWS tenant may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account. This way the attackers can keep persistance in the environment without adding new users.
+action.notable.param.rule_title = AWS Multi-Factor Authentication Disabled
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` (eventName= DeleteVirtualMFADevice OR eventName=DeactivateMFADevice) | stats count min(_time) as firstTime max(_time) as lastTime by src eventName eventSource aws_account_id userAgent eventID awsRegion user_name userIdentity.arn status | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_multi_factor_authentication_disabled_filter`
+
+[ESCU - AWS Multiple Failed MFA Requests For User - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies multiple failed multi-factor authentication requests to an AWS Console for a single user. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. AWS Environments can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies multiple failed multi-factor authentication requests to an AWS Console for a single user. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. AWS Environments can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
+action.escu.how_to_implement = The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
+action.escu.known_false_positives = Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
+action.escu.creation_date = 2022-10-03
+action.escu.modification_date = 2022-10-03
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - AWS Multiple Failed MFA Requests For User - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
+action.escu.analytic_story = ["AWS Identity and Access Management Account Takeover"]
+action.risk = 1
+action.risk.param._risk_message = User $user_name$ is seen to have high number of MFA prompt failures within a short period of time.
+action.risk.param._risk = [{"risk_object_field": "user_name", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 64}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - AWS Multiple Failed MFA Requests For User - Rule
+action.correlationsearch.annotations = {"analytic_story": ["AWS Identity and Access Management Account Takeover"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Cloud Data", "Outcome:Blocked", "Stage:Recon", "Other:Brute Force"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"], "observable": [{"name": "user_name", "role": ["Victim"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` eventName= ConsoleLogin "additionalEventData.MFAUsed"=Yes errorMessage="Failed authentication" | bucket span=5m _time |  stats dc(_raw) as mfa_prompts values(userAgent) as userAgent values(src) as src by _time user_name user_arn aws_account_id eventName errorMessage | where mfa_prompts > 10| `aws_multiple_failed_mfa_requests_for_user_filter`
+
 [ESCU - AWS Multiple Users Failing To Authenticate From Ip - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -2167,6 +2299,52 @@ realtime_schedule = 0
 is_visible = false
 search = `cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazonaws.com | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn) as policy_arn by src requestParameters.versionId eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_setdefaultpolicyversion_filter`

+[ESCU - AWS Successful Single-Factor Authentication - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a successful Console Login authentication event against an AWS IAM user for an account without Multi-Factor Authentication enabled. This could be evidence of a misconfiguration, a policy violation or an account take over attempt that should be investigated
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078.004"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a successful Console Login authentication event against an AWS IAM user for an account without Multi-Factor Authentication enabled. This could be evidence of a misconfiguration, a policy violation or an account take over attempt that should be investigated
+action.escu.how_to_implement = The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
+action.escu.known_false_positives = It is possible that some accounts do not have MFA enabled for the AWS account however its agaisnt the best practices of securing AWS.
+action.escu.creation_date = 2022-10-04
+action.escu.modification_date = 2022-10-04
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - AWS Successful Single-Factor Authentication - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
+action.escu.analytic_story = ["AWS Identity and Access Management Account Takeover"]
+action.risk = 1
+action.risk.param._risk_message = User $user_name$ has successfully logged into an AWS Console without Multi-Factor Authentication from $src$
+action.risk.param._risk = [{"risk_object_field": "user_name", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 64}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - AWS Successful Single-Factor Authentication - Rule
+action.correlationsearch.annotations = {"analytic_story": ["AWS Identity and Access Management Account Takeover"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Cloud Data"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078.004"], "nist": ["DE.CM"], "observable": [{"name": "user_name", "role": ["Victim"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies a successful Console Login authentication event against an AWS IAM user for an account without Multi-Factor Authentication enabled. This could be evidence of a misconfiguration, a policy violation or an account take over attempt that should be investigated
+action.notable.param.rule_title = AWS Successful Single-Factor Authentication
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` eventName= ConsoleLogin errorCode=success "additionalEventData.MFAUsed"=No | stats count min(_time) as firstTime max(_time) as lastTime by src eventName eventSource aws_account_id errorCode additionalEventData.MFAUsed userAgent eventID awsRegion user_name userIdentity.arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_successful_single_factor_authentication_filter`
+
 [ESCU - AWS Unusual Number of Failed Authentications From Ip - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -9794,7 +9972,7 @@ action.escu.full_search_name = ESCU - CertUtil Download With URLCache and Split
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"]
+action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land", "ProxyNotShell", "CISA AA22-277A"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -9805,7 +9983,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - CertUtil Download With URLCache and Split Arguments - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land", "ProxyNotShell", "CISA AA22-277A"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -10300,7 +10478,7 @@ action.escu.full_search_name = ESCU - CMD Carry Out String Command Parameter - R
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Data Destruction", "IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land", "Azorult", "DarkCrystal RAT"]
+action.escu.analytic_story = ["Data Destruction", "IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land", "Azorult", "DarkCrystal RAT", "ProxyNotShell"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}]
@@ -10311,7 +10489,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - CMD Carry Out String Command Parameter - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land", "Azorult", "DarkCrystal RAT"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "cve": ["CVE-2021-44228"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003", "T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land", "Azorult", "DarkCrystal RAT", "ProxyNotShell"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "cve": ["CVE-2021-44228"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003", "T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -10386,7 +10564,7 @@ action.escu.full_search_name = ESCU - Cmdline Tool Not Executed In CMD Shell - R
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["FIN7"]
+action.escu.analytic_story = ["FIN7", "CISA AA22-277A"]
 action.risk = 1
 action.risk.param._risk_message = A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -10397,7 +10575,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Cmdline Tool Not Executed In CMD Shell - Rule
-action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["FIN7", "CISA AA22-277A"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -10749,7 +10927,7 @@ action.escu.full_search_name = ESCU - Create or delete windows shares using net
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Hidden Cobra Malware"]
+action.escu.analytic_story = ["Hidden Cobra Malware", "CISA AA22-277A"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -10760,7 +10938,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Create or delete windows shares using net exe - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "CISA AA22-277A"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -11700,20 +11878,20 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 [ESCU - Detect Exchange Web Shell - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.
+description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell and ProxyNotShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003", "T1190"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.
+action.escu.eli5 = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell and ProxyNotShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
 action.escu.known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
-action.escu.creation_date = 2021-10-05
-action.escu.modification_date = 2021-10-05
+action.escu.creation_date = 2022-09-30
+action.escu.modification_date = 2022-09-30
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Exchange Web Shell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["HAFNIUM Group", "ProxyShell", "CISA AA22-257A"]
+action.escu.analytic_story = ["HAFNIUM Group", "ProxyShell", "CISA AA22-257A", "ProxyNotShell"]
 action.risk = 1
 action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
@@ -11724,11 +11902,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Exchange Web Shell - Rule
-action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell", "CISA AA22-257A"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003", "T1190"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]}
+action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell", "CISA AA22-257A", "ProxyNotShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003", "T1190"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.
+action.notable.param.rule_description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell and ProxyNotShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.
 action.notable.param.rule_title = Detect Exchange Web Shell
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -11741,7 +11919,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System  by _time span=1h Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time | table dest file_create_time, file_name, file_path, process_name | `detect_exchange_web_shell_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System  by _time span=1h Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name IN( "*.aspx", "*.ashx") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time | table dest file_create_time, file_name, file_path, process_name | `detect_exchange_web_shell_filter`

 [ESCU - Detect HTML Help Renamed - Rule]
 action.escu = 0
@@ -12882,7 +13060,7 @@ action.escu.full_search_name = ESCU - Detect Renamed WinRAR - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Collection and Staging"]
+action.escu.analytic_story = ["Collection and Staging", "CISA AA22-277A"]
 action.risk = 1
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -12893,7 +13071,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Renamed WinRAR - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging", "CISA AA22-277A"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -13145,8 +13323,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 action.escu.known_false_positives = False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
-action.escu.creation_date = 2021-05-27
-action.escu.modification_date = 2021-05-27
+action.escu.creation_date = 2022-10-09
+action.escu.modification_date = 2022-10-09
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect SharpHound File Modifications - Rule
 action.escu.search_type = detection
@@ -13180,7 +13358,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json") by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json", "*_ous.json", "*_containers.json") by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`

 [ESCU - Detect SharpHound Usage - Rule]
 action.escu = 0
@@ -16303,7 +16481,7 @@ action.escu.full_search_name = ESCU - Excessive Usage Of Taskkill - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["XMRig", "Azorult", "CISA AA22-264A", "AgentTesla"]
+action.escu.analytic_story = ["XMRig", "Azorult", "CISA AA22-264A", "AgentTesla", "CISA AA22-277A"]
 action.risk = 1
 action.risk.param._risk_message = Excessive usage  of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}]
@@ -16314,7 +16492,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Excessive Usage Of Taskkill - Rule
-action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Azorult", "CISA AA22-264A", "AgentTesla"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]}
+action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Azorult", "CISA AA22-264A", "AgentTesla", "CISA AA22-277A"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -16327,6 +16505,64 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe"  by Processes.parent_process_name Processes.process_name Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`

+[ESCU - Exchange PowerShell Module Usage - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Adversaries may abuse a limited set of PwSh Modules related to Exchange once gained access via ProxyShell or ProxyNotShell.\
+Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \
+Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \
+Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG). \
+Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \ Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).
+action.escu.mappings = {"kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059", "T1059.001"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Adversaries may abuse a limited set of PwSh Modules related to Exchange once gained access via ProxyShell or ProxyNotShell.\
+Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \
+Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \
+Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG). \
+Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \ Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).
+action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
+action.escu.creation_date = 2022-10-05
+action.escu.modification_date = 2022-10-05
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Exchange PowerShell Module Usage - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["ProxyShell", "CISA AA22-264A", "ProxyNotShell", "CISA AA22-277A"]
+action.risk = 1
+action.risk.param._risk_message = Suspicious Exchange PowerShell module usaged was identified on $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 32}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Exchange PowerShell Module Usage - Rule
+action.correlationsearch.annotations = {"analytic_story": ["ProxyShell", "CISA AA22-264A", "ProxyNotShell", "CISA AA22-277A"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 40, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Adversaries may abuse a limited set of PwSh Modules related to Exchange once gained access via ProxyShell or ProxyNotShell.\
+Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \
+Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \
+Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG). \
+Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \ Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).
+action.notable.param.rule_title = Exchange PowerShell Module Usage
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*", "*New-MailboxSearch*", "*Get-Recipient*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_module_usage_filter`
+
 [ESCU - Executable File Written in Administrative SMB Share - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -18915,7 +19151,7 @@ action.escu.full_search_name = ESCU - Impacket Lateral Movement Commandline Para
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Active Directory Lateral Movement", "WhisperGate", "Industroyer2"]
+action.escu.analytic_story = ["Active Directory Lateral Movement", "WhisperGate", "Industroyer2", "CISA AA22-277A"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious command line parameters on $dest may represent a lateral movement attack with Impackets tools
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}]
@@ -18926,7 +19162,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Impacket Lateral Movement Commandline Parameters - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "WhisperGate", "Industroyer2"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.002", "T1021.003", "T1047", "T1543.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "WhisperGate", "Industroyer2", "CISA AA22-277A"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.002", "T1021.003", "T1047", "T1543.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -24548,7 +24784,7 @@ action.escu.full_search_name = ESCU - Network Connection Discovery With Netstat
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Active Directory Discovery"]
+action.escu.analytic_story = ["Active Directory Discovery", "CISA AA22-277A"]
 action.risk = 1
 action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
@@ -24559,7 +24795,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Network Connection Discovery With Netstat - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "CISA AA22-277A"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -24588,7 +24824,7 @@ action.escu.full_search_name = ESCU - Network Discovery Using Route Windows App
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Active Directory Discovery"]
+action.escu.analytic_story = ["Active Directory Discovery", "CISA AA22-277A"]
 action.risk = 1
 action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}]
@@ -24599,7 +24835,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Network Discovery Using Route Windows App - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1016", "T1016.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "CISA AA22-277A"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1016", "T1016.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -32873,14 +33109,14 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This detection identifies Microsoft Exchange Server's Unified Messaging services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe and wermgr.exe mostly due to potential false positives, however, if there is an excessive amount of "wermgr.exe" or "WerFault.exe" failures, it may be due to the active exploitation. During triage, identify any additional suspicious parallel processes. Identify any recent out of place file modifications. Review Exchange logs following Microsofts guide. To contain, perform egress filtering or restrict public access to Exchange. In final, patch the vulnerablity and monitor.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = Unknown. Tune out child processes as needed to limit volume of false positives.
-action.escu.creation_date = 2021-03-02
-action.escu.modification_date = 2021-03-02
+action.escu.creation_date = 2022-10-03
+action.escu.modification_date = 2022-10-03
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unified Messaging Service Spawning a Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["HAFNIUM Group"]
+action.escu.analytic_story = ["HAFNIUM Group", "ProxyShell", "ProxyNotShell"]
 action.risk = 1
 action.risk.param._risk_message = Possible CVE-2021-26857 exploitation on $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}]
@@ -32891,14 +33127,8 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Unified Messaging Service Spawning a Process - Rule
-action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "cve": ["CVE-2021-26857"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell", "ProxyNotShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "cve": ["CVE-2021-26857"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This detection identifies Microsoft Exchange Server's Unified Messaging services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe and wermgr.exe mostly due to potential false positives, however, if there is an excessive amount of "wermgr.exe" or "WerFault.exe" failures, it may be due to the active exploitation. During triage, identify any additional suspicious parallel processes. Identify any recent out of place file modifications. Review Exchange logs following Microsofts guide. To contain, perform egress filtering or restrict public access to Exchange. In final, patch the vulnerablity and monitor.
-action.notable.param.rule_title = Unified Messaging Service Spawning a Process
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -32908,7 +33138,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="umworkerprocess.exe" OR Processes.parent_process_name="UMService.exe" (Processes.process_name!="wermgr.exe" OR Processes.process_name!="werfault.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `unified_messaging_service_spawning_a_process_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="umworkerprocess.exe" OR Processes.parent_process_name="UMService.exe" NOT (Processes.process_name IN ("wermgr.exe", "werfault.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `unified_messaging_service_spawning_a_process_filter`

 [ESCU - Uninstall App Using MsiExec - Rule]
 action.escu = 0
@@ -33370,7 +33600,7 @@ action.escu.full_search_name = ESCU - W3WP Spawning Shell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell", "CISA AA22-257A", "CISA AA22-264A"]
+action.escu.analytic_story = ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell", "CISA AA22-257A", "ProxyNotShell", "CISA AA22-264A"]
 action.risk = 1
 action.risk.param._risk_message = Possible Web Shell execution on $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}]
@@ -33381,7 +33611,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - W3WP Spawning Shell - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell", "CISA AA22-257A", "CISA AA22-264A"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "cve": ["CVE-2021-34473", "CVE-2021-34523", "CVE-2021-31207"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell", "CISA AA22-257A", "ProxyNotShell", "CISA AA22-264A"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "cve": ["CVE-2021-34473", "CVE-2021-34523", "CVE-2021-31207"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -34296,6 +34526,46 @@ realtime_schedule = 0
 is_visible = false
 search = `wineventlog_security` EventCode=4741 MSADChangedAttributes IN ("*HOST/*","*RestrictedKrbHost/*") AND New_UAC_Value=0x80 | eval Effecting_Account=mvindex(Security_ID,1) | eval New_Computer_Account_Name=mvindex(Security_ID,0) | stats count min(_time) as firstTime max(_time) as lastTime values(EventCode),values(Account_Domain),values(Security_ID), values(Effecting_Account), values(New_Computer_Account_Name),values(SAM_Account_Name),values(DNS_Host_Name),values(MSADChangedAttributes) by dest Logon_ID subject | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_computer_account_with_spn_filter`

+[ESCU - Windows Create Local Account - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a new local user account added to a computer. Note that, this should be restricted to critical assets.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a new local user account added to a computer. Note that, this should be restricted to critical assets.
+action.escu.how_to_implement = This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs.  More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/
+action.escu.known_false_positives = It is possible that an administrator created the account. Verifying activity with an administrator is advised. This analytic is set to anomaly to allow for risk to be added. Filter and tune as needed. Restrict to critical infrastructure to reduce any volume.
+action.escu.creation_date = 2022-10-05
+action.escu.modification_date = 2022-10-05
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Create Local Account - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Account Monitoring and Controls"]
+action.risk = 1
+action.risk.param._risk_message = The following $user$ was added to $dest$ as a local account.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Create Local Account - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 20, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change where All_Changes.result_id=4720 by All_Changes.user All_Changes.dest All_Changes.result All_Changes.action | `drop_dm_object_name("All_Changes")` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_create_local_account_filter`
+
 [ESCU - Windows Curl Download to Suspicious Path - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -37363,6 +37633,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mof_event_triggered_execution_via_wmi_filter`

+[ESCU - Windows Mshta Execution In Registry - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the usage of mshta.exe Windows binary in registry to execute malicious script. This technique was seen in kovter malware where it create several registry entry which is a encoded javascript and will be executed by another registry containing mshta and javascript activexobject to execute the encoded script using wscript.shell. This TTP is a good indication of kovter malware or other adversaries or threat actors leveraging fileless detection that survive system reboot.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies the usage of mshta.exe Windows binary in registry to execute malicious script. This technique was seen in kovter malware where it create several registry entry which is a encoded javascript and will be executed by another registry containing mshta and javascript activexobject to execute the encoded script using wscript.shell. This TTP is a good indication of kovter malware or other adversaries or threat actors leveraging fileless detection that survive system reboot.
+action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2022-10-14
+action.escu.modification_date = 2022-10-14
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Mshta Execution In Registry - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"]
+action.risk = 1
+action.risk.param._risk_message = a registry $registry_path$ contains mshta $registry_value_data$ in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Mshta Execution In Registry - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the usage of mshta.exe Windows binary in registry to execute malicious script. This technique was seen in kovter malware where it create several registry entry which is a encoded javascript and will be executed by another registry containing mshta and javascript activexobject to execute the encoded script using wscript.shell. This TTP is a good indication of kovter malware or other adversaries or threat actors leveraging fileless detection that survive system reboot.
+action.notable.param.rule_title = Windows Mshta Execution In Registry
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_data = "*mshta*" OR Registry.registry_value_data IN ("*javascript:*", "*vbscript:*","*WScript.Shell*") by Registry.registry_key_name Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mshta_execution_in_registry_filter`
+
 [ESCU - Windows MSIExec DLLRegisterServer - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -43011,28 +43327,28 @@ search = | tstats `security_content_summariesonly` count min(_time) values(Proce
 [ESCU - Exchange PowerShell Abuse via SSRF - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic identifies suspicious behavior related to ProxyShell against on-premise Microsoft Exchange servers. \
+description = This analytic identifies suspicious behavior related to ProxyShell against on-premise Microsoft Exchange servers. This analytic has been replaced by GUID d436f9e7-0ee7-4a47-864b-6dea2c4e2752 which utilizes the Web Datamodel. \
 Modification of this analytic is requried to ensure fields are mapped accordingly. \
 A suspicious event will have `PowerShell`, the method `POST` and `autodiscover.json`. This is indicative of accessing PowerShell on the back end of Exchange with SSRF. \
 An event will look similar to `POST /autodiscover/autodiscover.json a=dsxvu@fnsso.flq/powershell/?X-Rps-CAT=VgEAVAdXaW5kb3d...` (abbreviated) \
 Review the source attempting to perform this activity against your environment. In addition, review PowerShell logs and access recently granted to Exchange roles.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 action.escu.data_models = []
-action.escu.eli5 = This analytic identifies suspicious behavior related to ProxyShell against on-premise Microsoft Exchange servers. \
+action.escu.eli5 = This analytic identifies suspicious behavior related to ProxyShell against on-premise Microsoft Exchange servers. This analytic has been replaced by GUID d436f9e7-0ee7-4a47-864b-6dea2c4e2752 which utilizes the Web Datamodel. \
 Modification of this analytic is requried to ensure fields are mapped accordingly. \
 A suspicious event will have `PowerShell`, the method `POST` and `autodiscover.json`. This is indicative of accessing PowerShell on the back end of Exchange with SSRF. \
 An event will look similar to `POST /autodiscover/autodiscover.json a=dsxvu@fnsso.flq/powershell/?X-Rps-CAT=VgEAVAdXaW5kb3d...` (abbreviated) \
 Review the source attempting to perform this activity against your environment. In addition, review PowerShell logs and access recently granted to Exchange roles.
 action.escu.how_to_implement = The following analytic requires on-premise Exchange to be logging to Splunk using the TA - https://splunkbase.splunk.com/app/3225. Ensure logs are parsed correctly, or tune the analytic for your environment.
 action.escu.known_false_positives = Limited false positives, however, tune as needed.
-action.escu.creation_date = 2021-08-27
-action.escu.modification_date = 2021-08-27
+action.escu.creation_date = 2022-10-02
+action.escu.modification_date = 2022-10-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Exchange PowerShell Abuse via SSRF - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
-action.escu.analytic_story = ["ProxyShell"]
+action.escu.analytic_story = ["ProxyShell", "ProxyNotShell"]
 action.risk = 1
 action.risk.param._risk_message = Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}]
@@ -43043,11 +43359,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Exchange PowerShell Abuse via SSRF - Rule
-action.correlationsearch.annotations = {"analytic_story": ["ProxyShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["ProxyShell", "ProxyNotShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic identifies suspicious behavior related to ProxyShell against on-premise Microsoft Exchange servers. \
+action.notable.param.rule_description = This analytic identifies suspicious behavior related to ProxyShell against on-premise Microsoft Exchange servers. This analytic has been replaced by GUID d436f9e7-0ee7-4a47-864b-6dea2c4e2752 which utilizes the Web Datamodel. \
 Modification of this analytic is requried to ensure fields are mapped accordingly. \
 A suspicious event will have `PowerShell`, the method `POST` and `autodiscover.json`. This is indicative of accessing PowerShell on the back end of Exchange with SSRF. \
 An event will look similar to `POST /autodiscover/autodiscover.json a=dsxvu@fnsso.flq/powershell/?X-Rps-CAT=VgEAVAdXaW5kb3d...` (abbreviated) \
@@ -43064,65 +43380,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | `exchange` c_uri="*//autodiscover.json*" cs_uri_query="*PowerShell*" cs_method="POST" | stats count min(_time) as firstTime max(_time) as lastTime by dest, cs_uri_query, cs_method, c_uri | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_abuse_via_ssrf_filter`
-
-[ESCU - Exchange PowerShell Module Usage - Rule]
-action.escu = 0
-action.escu.enabled = 1
-description = The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Currently, there is no active data shared or data we could re-produce relate to this part of the ProxyShell chain of exploits.  \
-Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \
-Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \
-Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG). \
-Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \ Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).
-action.escu.mappings = {"kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059", "T1059.001"]}
-action.escu.data_models = []
-action.escu.eli5 = The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Currently, there is no active data shared or data we could re-produce relate to this part of the ProxyShell chain of exploits.  \
-Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \
-Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \
-Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG). \
-Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \ Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).
-action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-action.escu.creation_date = 2022-09-22
-action.escu.modification_date = 2022-09-22
-action.escu.confidence = high
-action.escu.full_search_name = ESCU - Exchange PowerShell Module Usage - Rule
-action.escu.search_type = detection
-action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["ProxyShell", "CISA AA22-264A"]
-action.risk = 1
-action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
-action.risk.param._risk_score = 0
-action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
-action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Exchange PowerShell Module Usage - Rule
-action.correlationsearch.annotations = {"analytic_story": ["ProxyShell", "CISA AA22-264A"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
-schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Currently, there is no active data shared or data we could re-produce relate to this part of the ProxyShell chain of exploits.  \
-Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \
-Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \
-Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG). \
-Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \ Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).
-action.notable.param.rule_title = Exchange PowerShell Module Usage
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
-alert.digest_mode = 1
-disabled = true
-enableSched = 1
-allow_skew = 100%
-counttype = number of events
-relation = greater than
-quantity = 0
-realtime_schedule = 0
-is_visible = false
-search = `powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*", "*New-MailboxSearch*", "*Get-Recipient*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_module_usage_filter`
+search = `exchange` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST" | stats count min(_time) as firstTime max(_time) as lastTime by dest, cs_uri_query, cs_method, c_uri | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_abuse_via_ssrf_filter`

 [ESCU - First Time Seen Child Process of Zoom - Rule]
 action.escu = 0
@@ -44261,7 +44519,7 @@ description = The following analytic uses a pretrained deep learning model to de
 action.escu.mappings = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1568.002"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
 action.escu.data_models = ["Network_Resolution"]
 action.escu.eli5 = The following analytic uses a pretrained deep learning model to detect Domain Generation Algorithm (DGA) generated domains. The model is trained independently and is then made available for download. One of the prominent indicators of a domain being DGA generated is if the domain name consists of unusual character sequences or concatenated dictionary words. Adversaries often use clever techniques to obfuscate machine generated domain names as human generated. Predicting DGA generated domain names requires analysis and building a model based on carefully chosen features. The deep learning model we have developed uses the domain name to anlayze patterns of character sequences along with carefully chosen custom features to predict if a domain is DGA generated. The model takes a domain name consisting of second-level and top-level domain names as input and outputs a dga_score. Higher the dga_score, the more likely the input domain is a DGA domain. The threshold for flagging a domain as DGA is set at 0.5.
-action.escu.how_to_implement =  * Steps to deploy DGA detection model into Splunk App DSDL. This detection depends on the Splunk app for Data Science and Deep Learning which can be found here - https://splunkbase.splunk.com/app/4607/ and the Network Resolution datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. The detection uses a pre-trained deep learning model that needs to be deployed in DSDL app. Follow the steps for deployment here - https://github.com/splunk/security_content/wiki/How-to-deploy-Deep-Learning-models-for-ESCU. * Download the artifacts .tar.gz file from the link - https://seal.splunkresearch.com/pretrained_dga_model_dsdl.tar.gz * Download the pretrained_dga_model_dsdl.ipynb Jupyter notebook from https://github.com/splunk/security_content/notebooks * Login to the Jupyter Lab for pretrained_dga_model_dsdl container. This container should be listed on Containers page for DSDL app. * Below steps need to be followed inside Jupyter lab * Upload the pretrained_dga_model_dsdl.tar.gz file into app/model/data path using the upload option in the jupyter notebook. * Untar the artifact pretrained_dga_model_dsdl.tar.gz using tar -xf app/model/data/pretrained_dga_model_dsdl.tar.gz -C app/model/data * Upload pretrained_dga_model_dsdl.pynb into Jupyter lab notebooks folder using the upload option in Jupyter lab * Save the notebook using the save option in jupyter notebook. * Upload pretrained_dga_model_dsdl.json into notebooks/data folder.
+action.escu.how_to_implement =  * Steps to deploy DGA detection model into Splunk App DSDL. This detection depends on the Splunk app for Data Science and Deep Learning which can be found here - https://splunkbase.splunk.com/app/4607/ and the Network Resolution datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. The detection uses a pre-trained deep learning model that needs to be deployed in DSDL app. Follow the steps for deployment here - https://github.com/splunk/security_content/wiki/How-to-deploy-pre-trained-Deep-Learning-models-for-ESCU. * Download the artifacts .tar.gz file from the link - https://seal.splunkresearch.com/pretrained_dga_model_dsdl.tar.gz * Download the pretrained_dga_model_dsdl.ipynb Jupyter notebook from https://github.com/splunk/security_content/notebooks * Login to the Jupyter Lab for pretrained_dga_model_dsdl container. This container should be listed on Containers page for DSDL app. * Below steps need to be followed inside Jupyter lab * Upload the pretrained_dga_model_dsdl.tar.gz file into app/model/data path using the upload option in the jupyter notebook. * Untar the artifact pretrained_dga_model_dsdl.tar.gz using tar -xf app/model/data/pretrained_dga_model_dsdl.tar.gz -C app/model/data * Upload pretrained_dga_model_dsdl.pynb into Jupyter lab notebooks folder using the upload option in Jupyter lab * Save the notebook using the save option in jupyter notebook. * Upload pretrained_dga_model_dsdl.json into notebooks/data folder.
 action.escu.known_false_positives = False positives may be present if domain name is similar to dga generated domains.
 action.escu.creation_date = 2022-09-15
 action.escu.modification_date = 2022-09-15
@@ -46111,6 +46369,47 @@ realtime_schedule = 0
 is_visible = false
 search = | from datamodel Web.Web | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)(?<proto>\w+)(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?(?<affected_host>[a-zA-Z0-9\.\-\_\$]+)" | join affected_host type=inner [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest | `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename dest AS affected_host] | fillnull | stats count by action, category, dest, dest_port, http_content_type, http_method, http_referrer, http_user_agent, site, src, url, url_domain, user | `log4shell_jndi_payload_injection_with_outbound_connection_filter`

+[ESCU - ProxyShell ProxyNotShell Behavior Detected - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following correlation will identify activity related to Windows Exchange being actively exploited by adversaries related to ProxyShell or ProxyNotShell. In addition, the analytic correlates post-exploitation Cobalt Strike analytic story. Common post-exploitation behavior has been seen in the wild includes adversaries running nltest, Cobalt Strike, Mimikatz and adding a new user. The correlation specifically looks for 5 distict analyticstories to trigger, modify or tune as needed for your organization. 5 analytic stories is an arbitrary number but was chosen to reduce the amount of noise but also require the 3 analytic stories to fire. Adversaries will exploit the vulnerable Exchange server, abuse SSRF, drop a web shell, utilize the PowerShell Exchange modules and begin post-exploitation.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Risk"]
+action.escu.eli5 = The following correlation will identify activity related to Windows Exchange being actively exploited by adversaries related to ProxyShell or ProxyNotShell. In addition, the analytic correlates post-exploitation Cobalt Strike analytic story. Common post-exploitation behavior has been seen in the wild includes adversaries running nltest, Cobalt Strike, Mimikatz and adding a new user. The correlation specifically looks for 5 distict analyticstories to trigger, modify or tune as needed for your organization. 5 analytic stories is an arbitrary number but was chosen to reduce the amount of noise but also require the 3 analytic stories to fire. Adversaries will exploit the vulnerable Exchange server, abuse SSRF, drop a web shell, utilize the PowerShell Exchange modules and begin post-exploitation.
+action.escu.how_to_implement = To implement this correlation, you will need to enable ProxyShell, ProxyNotShell and Cobalt Strike analytic stories (the anaytics themselves) and ensure proper data is being collected for Web and Endpoint datamodels. Run the correlation rule seperately to validate it is not triggering too much or generating incorrectly. Validate by running ProxyShell POC code and Cobalt Strike behavior.
+action.escu.known_false_positives = False positives will be limited, however tune or modify the query as needed.
+action.escu.creation_date = 2022-10-03
+action.escu.modification_date = 2022-10-03
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - ProxyShell ProxyNotShell Behavior Detected - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["ProxyShell", "ProxyNotShell"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - RIR - ProxyShell ProxyNotShell Behavior Detected - Rule
+action.correlationsearch.annotations = {"analytic_story": ["ProxyShell", "ProxyNotShell"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Scope:Network"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "risk_object", "role": ["Victim"], "type": "Hostname"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following correlation will identify activity related to Windows Exchange being actively exploited by adversaries related to ProxyShell or ProxyNotShell. In addition, the analytic correlates post-exploitation Cobalt Strike analytic story. Common post-exploitation behavior has been seen in the wild includes adversaries running nltest, Cobalt Strike, Mimikatz and adding a new user. The correlation specifically looks for 5 distict analyticstories to trigger, modify or tune as needed for your organization. 5 analytic stories is an arbitrary number but was chosen to reduce the amount of noise but also require the 3 analytic stories to fire. Adversaries will exploit the vulnerable Exchange server, abuse SSRF, drop a web shell, utilize the PowerShell Exchange modules and begin post-exploitation.
+action.notable.param.rule_title = RBA: ProxyShell ProxyNotShell Behavior Detected
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.analyticstories) as analyticstories values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count dc(All_Risk.analyticstories) as dc_analyticstories from datamodel=Risk.All_Risk where All_Risk.analyticstories IN ("ProxyNotShell","ProxyShell", "Cobalt Strike")   All_Risk.risk_object_type="system" by _time span=1h All_Risk.risk_object All_Risk.risk_object_type | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where dc_analyticstories >= 5 | `proxyshell_proxynotshell_behavior_detected_filter`
+
 [ESCU - Spring4Shell Payload URL Request - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -46375,6 +46674,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats count from datamodel=Web where Web.http_method IN ("POST") Web.url="*/functionRouter*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest Web.status sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_spring_cloud_function_functionrouter_filter`

+[ESCU - Windows Exchange Autodiscover SSRF Abuse - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic utilizes the Web datamodel and identifies the ProxyShell or ProxyNotShell abuse. This vulnerability is a Server Side Request Forgery (SSRF) vulnerability, which is a web vulnerability that allows an adversary to exploit vulnerable functionality to access server side or local network services by affectively traversing the external firewall using vulnerable web functionality. This analytic looks for the URI path and query of autodiscover, powershell and mapi along with a POST occurring. It will tally a simple score and show the output of the events that match. This analytic may be added to by simply creating a new eval statement and modifying the hardcode digit for Score.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Web"]
+action.escu.eli5 = The following analytic utilizes the Web datamodel and identifies the ProxyShell or ProxyNotShell abuse. This vulnerability is a Server Side Request Forgery (SSRF) vulnerability, which is a web vulnerability that allows an adversary to exploit vulnerable functionality to access server side or local network services by affectively traversing the external firewall using vulnerable web functionality. This analytic looks for the URI path and query of autodiscover, powershell and mapi along with a POST occurring. It will tally a simple score and show the output of the events that match. This analytic may be added to by simply creating a new eval statement and modifying the hardcode digit for Score.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. In addition, confirm the latest CIM App 4.20 or higher is installed.
+action.escu.known_false_positives = False positives are limited.
+action.escu.creation_date = 2022-10-03
+action.escu.modification_date = 2022-10-03
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Exchange Autodiscover SSRF Abuse - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["ProxyShell", "ProxyNotShell"]
+action.risk = 1
+action.risk.param._risk_message = Activity related to ProxyShell or ProxyNotShell has been identified on $dest$. Review events and take action accordingly.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Exchange Autodiscover SSRF Abuse - Rule
+action.correlationsearch.annotations = {"analytic_story": ["ProxyShell", "ProxyNotShell"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Scope:Network"], "cve": ["CVE-2021-34523", "CVE-2021-34473", "CVE-2021-31207", "CVE-2022-41040", "CVE-2022-41082"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic utilizes the Web datamodel and identifies the ProxyShell or ProxyNotShell abuse. This vulnerability is a Server Side Request Forgery (SSRF) vulnerability, which is a web vulnerability that allows an adversary to exploit vulnerable functionality to access server side or local network services by affectively traversing the external firewall using vulnerable web functionality. This analytic looks for the URI path and query of autodiscover, powershell and mapi along with a POST occurring. It will tally a simple score and show the output of the events that match. This analytic may be added to by simply creating a new eval statement and modifying the hardcode digit for Score.
+action.notable.param.rule_title = Windows Exchange Autodiscover SSRF Abuse
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where (Web.status=200 OR Web.status=302 OR Web.status=401) AND Web.http_method=POST by Web.src Web.status Web.uri_path Web.dest Web.http_method Web.uri_query | `drop_dm_object_name("Web")` | eval is_autodiscover=if(like(lower(uri_path),"%autodiscover%"),1,0) | eval powershell = if(match(lower(uri_query),"powershell"), "1",0) | eval mapi=if(like(uri_query,"%/mapi/%"),1,0) | addtotals fieldname=Score is_autodiscover, powershell, mapi | fields Score, src,dest, status, uri_query,uri_path,http_method | where Score >= 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_exchange_autodiscover_ssrf_abuse_filter`
+
 ### END ESCU DETECTIONS ###

 ### ESCU BASELINES ###
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-14T19:00:36 UTC
+# On Date: 2022-10-18T20:46:45 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -150,6 +150,14 @@ case_sensitive_match = false
 match_type = WILDCARD(local_file_inclusion_paths)
 min_matches = 1

+[lolbas_file_path]
+filename = lolbas_file_path.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of LOLBAS and their file path used in determining if a script or binary is valid on windows
+match_type = WILDCARD(lolbas_file_name)
+min_matches = 1
+
 [lookup_rare_process_allow_list_default]
 filename = rare_process_allow_list_default.csv
 default_match = false
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-14T19:00:36 UTC
+# On Date: 2022-10-18T20:46:45 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -25,4 +25,5 @@ NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Au
 ns.exe,A commonly used tool used by attackers to scan and map file shares
 SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
 kportscan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking Forums to perform network scanning on the internal networks.
-advanced_port_scanner.exe, Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports.
+advanced_port_scanner.exe,Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports.
+mimikatz.exe,utility Mimikatz is an open-source application that allows users to view and save authentication credentials such as Kerberos tickets.
@@ -0,0 +1,480 @@
+lolbas_file_name,lolbas_file_path,description
+eventvwr.exe,c:\windows\system32\*,Displays Windows Event Logs in a GUI window.
+eventvwr.exe,c:\windows\syswow64\*,Displays Windows Event Logs in a GUI window.
+rasautou.exe,c:\windows\system32\*,Windows Remote Access Dialer
+regedit.exe,c:\windows\system32\*,Used by Windows to manipulate registry
+regedit.exe,c:\windows\syswow64\*,Used by Windows to manipulate registry
+regsvr32.exe,c:\windows\system32\*,Used by Windows to register dlls
+regsvr32.exe,c:\windows\syswow64\*,Used by Windows to register dlls
+control.exe,c:\windows\system32\*,Binary used to launch controlpanel items in Windows
+control.exe,c:\windows\syswow64\*,Binary used to launch controlpanel items in Windows
+configsecuritypolicy.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.9-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender. you can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
+scriptrunner.exe,c:\windows\system32\*,Execute binary through proxy binary to evade defensive counter measures
+scriptrunner.exe,c:\windows\syswow64\*,Execute binary through proxy binary to evade defensive counter measures
+offlinescannershell.exe,c:\program files\windows defender\offline\*,Windows Defender Offline Shell
+atbroker.exe,c:\windows\system32\*,Helper binary for Assistive Technology (AT)
+atbroker.exe,c:\windows\syswow64\*,Helper binary for Assistive Technology (AT)
+mmc.exe,c:\windows\system32\*,Load snap-ins to locally and remotely manage Windows systems
+mmc.exe,c:\windows\syswow64\*,Load snap-ins to locally and remotely manage Windows systems
+mavinject.exe,c:\windows\system32\*,Used by App-v in Windows
+mavinject.exe,c:\windows\syswow64\*,Used by App-v in Windows
+ftp.exe,c:\windows\system32\*,A binary designed for connecting to FTP servers
+ftp.exe,c:\windows\syswow64\*,A binary designed for connecting to FTP servers
+ttdinject.exe,c:\windows\system32\*,Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
+ttdinject.exe,c:\windows\syswow64\*,Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
+certoc.exe,c:\windows\system32\*,Used for installing certificates
+certoc.exe,c:\windows\syswow64\*,Used for installing certificates
+at.exe,c:\windows\system32\*,Schedule periodic tasks
+at.exe,c:\windows\syswow64\*,Schedule periodic tasks
+netsh.exe,c:\windows\system32\*,Netsh is a Windows tool used to manipulate network interface settings.
+netsh.exe,c:\windows\syswow64\*,Netsh is a Windows tool used to manipulate network interface settings.
+pnputil.exe,c:\windows\system32\*,Used for installing drivers
+ie4uinit.exe,c:\windows\system32\*,Executes commands from a specially prepared ie4uinit.inf file.
+ie4uinit.exe,c:\windows\syswow64\*,Executes commands from a specially prepared ie4uinit.inf file.
+infdefaultinstall.exe,c:\windows\system32\*,Binary used to perform installation based on content inside inf files
+infdefaultinstall.exe,c:\windows\syswow64\*,Binary used to perform installation based on content inside inf files
+forfiles.exe,c:\windows\system32\*,Selects and executes a command on a file or set of files. This command is useful for batch processing.
+forfiles.exe,c:\windows\syswow64\*,Selects and executes a command on a file or set of files. This command is useful for batch processing.
+register-cimprovider.exe,c:\windows\system32\*,Used to register new wmi providers
+register-cimprovider.exe,c:\windows\syswow64\*,Used to register new wmi providers
+tttracer.exe,c:\windows\system32\*,Used by Windows 1809 and newer to Debug Time Travel
+tttracer.exe,c:\windows\syswow64\*,Used by Windows 1809 and newer to Debug Time Travel
+xwizard.exe,c:\windows\system32\*,Execute custom class that has been added to the registry or download a file with Xwizard.exe
+xwizard.exe,c:\windows\syswow64\*,Execute custom class that has been added to the registry or download a file with Xwizard.exe
+pcalua.exe,c:\windows\system32\*,Program Compatibility Assistant
+print.exe,c:\windows\system32\*,Used by Windows to send files to the printer
+print.exe,c:\windows\syswow64\*,Used by Windows to send files to the printer
+runscripthelper.exe,c:\windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.15_none_c2df1bba78111118\*,Execute target PowerShell script
+runscripthelper.exe,c:\windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.192_none_ad4699b571e00c4a\*,Execute target PowerShell script
+regasm.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,Part of .NET
+regasm.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,Part of .NET
+regasm.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Part of .NET
+regasm.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Part of .NET
+cmd.exe,c:\windows\system32\*,The command-line interpreter in Windows
+cmd.exe,c:\windows\syswow64\*,The command-line interpreter in Windows
+msbuild.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,Used to compile and execute code
+msbuild.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,Used to compile and execute code
+msbuild.exe,c:\windows\microsoft.net\framework\v3.5\*,Used to compile and execute code
+msbuild.exe,c:\windows\microsoft.net\framework64\v3.5\*,Used to compile and execute code
+msbuild.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Used to compile and execute code
+msbuild.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Used to compile and execute code
+msbuild.exe,c:\program files (x86)\msbuild\14.0\bin\*,Used to compile and execute code
+certutil.exe,c:\windows\system32\*,Windows binary used for handling certificates
+certutil.exe,c:\windows\syswow64\*,Windows binary used for handling certificates
+vbc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Binary file used for compile vbs code
+vbc.exe,c:\windows\microsoft.net\framework64\v3.5\*,Binary file used for compile vbs code
+psr.exe,c:\windows\system32\*,"Windows Problem Steps Recorder, used to record screen and clicks."
+psr.exe,c:\windows\syswow64\*,"Windows Problem Steps Recorder, used to record screen and clicks."
+extexport.exe,c:\program files\internet explorer\*,Load a DLL located in the c:\test folder with a specific name.
+extexport.exe,c:\program files (x86)\internet explorer\*,Load a DLL located in the c:\test folder with a specific name.
+rpcping.exe,c:\windows\system32\*,Used to verify rpc connection
+rpcping.exe,c:\windows\syswow64\*,Used to verify rpc connection
+msdt.exe,c:\windows\system32\*,Microsoft diagnostics tool
+msdt.exe,c:\windows\syswow64\*,Microsoft diagnostics tool
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\64kb6472.inf_amd64_3daef03bbe98572b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_0e9c57ae3396e055\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_209bd95d56b1ac2d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_3fa2a843f8b7f16d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_85c860f05274baa0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_f7412e3e3404de80\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_feb9f1cf05b0de58\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_component.inf_amd64_0219cc1c7085a93f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_component.inf_amd64_df4f60b1cae9b14a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_16eb18b0e2526e57\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_31c60cc38cfcca28\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_82f69cea8b2d928f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_b4d94f3e41ceb839\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_0606619cc97463de\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_0e95edab338ad669\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_22aac1442d387216\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_2461d914696db722\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_29d727269a34edf5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_2caf76dbce56546d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_353320edb98da643\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_4ea0ed0af1507894\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_56a48f4f1c2da7a7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_64f23fdadb76a511\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_668dd0c6d3f9fa0e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_6be8e5b7f731a6e5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_6dad7e4e9a8fa889\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_6df442103a1937a4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_767e7683f9ad126c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_8644298f665a12c4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_868acf86149aef5d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_92cf9d9d84f1d3db\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_93239c65f222d453\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_9de8154b682af864\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_a7428663aca90897\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_ad7cb5e55a410add\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_afbf41cf8ab202d7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_d193c96475eaa96e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_db953c52208ada71\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_e7523682cc7528cc\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_e9f341319ca84274\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_f3a64c75ee4defb7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_f51939e52b944f4b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch_comp.inf_amd64_4938423c9b9639d7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch_comp.inf_amd64_c8e108d4a62c59d5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch_comp.inf_amd64_deecec7d232ced2b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_01ee1299f4982efe\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_02edfc87000937e4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0541b698fc6e40b0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0707757077710fff\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0b3e3ed3ace9602a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0cff362f9dff4228\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_16ed7d82b93e4f68\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1a33d2f73651d989\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1aca2a92a37fce23\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1af2dd3e4df5fd61\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1d571527c7083952\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_23f7302c2b9ee813\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_24de78387e6208e4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_250db833a1cd577e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_25e7c5a58c052bc5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_28d80681d3523b1c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_2dda3b1147a3a572\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_31ba00ea6900d67d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_329877a66f240808\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_42af9f4718aa1395\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_4645af5c659ae51a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_48c2e68e54c92258\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_48e7e903a369eae2\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_491d20003583dabe\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_4b34c18659561116\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_51ce968bf19942c2\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_555cfc07a674ecdd\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_561bd21d54545ed3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_579a75f602cc2dce\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_57f66a4f0a97f1a3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_587befb80671fb38\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_62f096fe77e085c0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_6ae0ddbb4a38e23c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_6bb02522ea3fdb0d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_6d34ac0763025a06\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_712b6a0adbaabc0a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_78b09d9681a2400f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_842874489af34daa\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_88084eb1fe7cebc3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_89033455cb08186f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_8a9535cd18c90bc3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_8c1fc948b5a01c52\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_9088b61921a6ff9f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_90f68cd0dc48b625\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_95cb371d046d4b4c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_a58de0cf5f3e9dca\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_abe9d37302f8b1ae\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_acb3edda7b82982f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_aebc5a8535dd3184\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_b5d4c82c67b39358\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_b846bbf1e81ea3cf\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_babb2e8b8072ff3b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_bc75cebf5edbbc50\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_be91293cf20d4372\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c11f4d5f0bc4c592\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c4e5173126d31cf0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c4f600ffe34acc7b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c8634ed19e331cda\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c9081e50bcffa972\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_ceddadac8a2b489e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_d4406f0ad6ec2581\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_d5877a2e0e6374b6\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_d8ca5f86add535ef\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_e8abe176c7b553b5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_eabb3ac2c517211f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_f8d8be8fea71e1a0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_fe5e116bb07c0629\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_fe73d2ebaa05fb95\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64_kbl_kit127397.inf_amd64_e1da8ee9e92ccadb\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\k127153.inf_amd64_364f43f2a27f7bd7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\k127153.inf_amd64_3f3936d8dec668b8\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\k127793.inf_amd64_3ab7883eddccbf0f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129523.inf_amd64_32947eecf8f3e231\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126950.inf_amd64_fa7f56314967630d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126951.inf_amd64_94804e3918169543\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126973.inf_amd64_06dde156632145e3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126974.inf_amd64_9168fc04b8275db9\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127005.inf_amd64_753576c4406c1193\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127018.inf_amd64_0f67ff47e9e30716\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127021.inf_amd64_0d68af55c12c7c17\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127171.inf_amd64_368f8c7337214025\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127176.inf_amd64_86c658cabfb17c9c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127390.inf_amd64_e1ccb879ece8f084\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127678.inf_amd64_8427d3a09f47dfc1\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127727.inf_amd64_cf8e31692f82192e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127807.inf_amd64_fc915899816dbc5d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127850.inf_amd64_6ad8d99023b59fd5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki128602.inf_amd64_6ff790822fd674ab\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki128916.inf_amd64_3509e1eb83b83cfb\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129407.inf_amd64_f26f36ac54ce3076\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129633.inf_amd64_d9b8af875f664a8c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129866.inf_amd64_e7cdca9882c16f55\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130274.inf_amd64_bafd2440fa1ffdd6\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130350.inf_amd64_696b7c6764071b63\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130409.inf_amd64_0d8d61270dfb4560\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130471.inf_amd64_26ad6921447aa568\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130624.inf_amd64_d85487143eec5e1a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130825.inf_amd64_ee3ba427c553f15f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130871.inf_amd64_382f7c369d4bf777\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131064.inf_amd64_5d13f27a9a9843fa\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131176.inf_amd64_fb4fe914575fdd15\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131191.inf_amd64_d668106cb6f2eae0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131622.inf_amd64_0058d71ace34db73\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132032.inf_amd64_f29660d80998e019\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132337.inf_amd64_223d6831ffa64ab1\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132535.inf_amd64_7875dff189ab2fa2\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132544.inf_amd64_b8c1f31373153db4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132574.inf_amd64_54c9b905b975ee55\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132869.inf_amd64_052eb72d070df60f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\kit126731.inf_amd64_1905c9d5f38631d9\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
+dnscmd.exe,c:\windows\system32\*,A command-line interface for managing DNS servers
+dnscmd.exe,c:\windows\syswow64\*,A command-line interface for managing DNS servers
+wab.exe,c:\program files\windows mail\*,Windows address book manager
+wab.exe,c:\program files (x86)\windows mail\*,Windows address book manager
+msconfig.exe,c:\windows\system32\*,"MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows"
+wscript.exe,c:\windows\system32\*,Used by Windows to execute scripts
+wscript.exe,c:\windows\syswow64\*,Used by Windows to execute scripts
+makecab.exe,c:\windows\system32\*,Binary to package existing files into a cabinet (.cab) file
+makecab.exe,c:\windows\syswow64\*,Binary to package existing files into a cabinet (.cab) file
+datasvcutil.exe,c:\windows\microsoft.net\framework64\v3.5\*,DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application.
+cmdl32.exe,c:\windows\system32\*,Microsoft Connection Manager Auto-Download
+cmdl32.exe,c:\windows\syswow64\*,Microsoft Connection Manager Auto-Download
+mshta.exe,c:\windows\system32\*,Used by Windows to execute html applications. (.hta)
+mshta.exe,c:\windows\syswow64\*,Used by Windows to execute html applications. (.hta)
+cmdkey.exe,c:\windows\system32\*,"creates, lists, and deletes stored user names and passwords or credentials."
+cmdkey.exe,c:\windows\syswow64\*,"creates, lists, and deletes stored user names and passwords or credentials."
+ilasm.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,used for compile c# code into dll or exe.
+ilasm.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,used for compile c# code into dll or exe.
+rdrleakdiag.exe,c:\windows\system32\*,Microsoft Windows resource leak diagnostic tool
+rdrleakdiag.exe,c:\windows\syswow64\*,Microsoft Windows resource leak diagnostic tool
+mpcmdrun.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.4-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender
+mpcmdrun.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.7-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender
+mpcmdrun.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.9-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender
+jsc.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Binary file used by .NET to compile javascript code to .exe or .dll format
+jsc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Binary file used by .NET to compile javascript code to .exe or .dll format
+jsc.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,Binary file used by .NET to compile javascript code to .exe or .dll format
+jsc.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,Binary file used by .NET to compile javascript code to .exe or .dll format
+cmstp.exe,c:\windows\system32\*,Installs or removes a Connection Manager service profile.
+cmstp.exe,c:\windows\syswow64\*,Installs or removes a Connection Manager service profile.
+stordiag.exe,c:\windows\system32\*,Storage diagnostic tool
+stordiag.exe,c:\windows\syswow64\*,Storage diagnostic tool
+odbcconf.exe,c:\windows\system32\*,Used in Windows for managing ODBC connections
+odbcconf.exe,c:\windows\syswow64\*,Used in Windows for managing ODBC connections
+wlrmdr.exe,c:\windows\system32\*,Windows Logon Reminder executable
+printbrm.exe,c:\windows\system32\spool\tools\*,Printer Migration Command-Line Tool
+dfsvc.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,ClickOnce engine in Windows used by .NET
+dfsvc.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,ClickOnce engine in Windows used by .NET
+dfsvc.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,ClickOnce engine in Windows used by .NET
+dfsvc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,ClickOnce engine in Windows used by .NET
+extrac32.exe,c:\windows\system32\*,"Extract to ADS, copy or overwrite a file with Extrac32.exe"
+extrac32.exe,c:\windows\syswow64\*,"Extract to ADS, copy or overwrite a file with Extrac32.exe"
+rundll32.exe,c:\windows\system32\*,Used by Windows to execute dll files
+rundll32.exe,c:\windows\syswow64\*,Used by Windows to execute dll files
+runonce.exe,c:\windows\system32\*,Executes a Run Once Task that has been configured in the registry
+runonce.exe,c:\windows\syswow64\*,Executes a Run Once Task that has been configured in the registry
+explorer.exe,c:\windows\*,Binary used for managing files and system components within Windows
+explorer.exe,c:\windows\syswow64\*,Binary used for managing files and system components within Windows
+wuauclt.exe,c:\windows\system32\*,Windows Update Client
+wsreset.exe,c:\windows\system32\*,Used to reset Windows Store settings according to its manifest file
+finger.exe,c:\windows\system32\*,Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
+finger.exe,c:\windows\syswow64\*,Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
+regini.exe,c:\windows\system32\*,Used to manipulate the registry
+regini.exe,c:\windows\syswow64\*,Used to manipulate the registry
+reg.exe,c:\windows\system32\*,Used to manipulate the registry
+reg.exe,c:\windows\syswow64\*,Used to manipulate the registry
+syncappvpublishingserver.exe,c:\windows\system32\*,Used by App-v to get App-v server lists
+syncappvpublishingserver.exe,c:\windows\syswow64\*,Used by App-v to get App-v server lists
+bitsadmin.exe,c:\windows\system32\*,Used for managing background intelligent transfer
+bitsadmin.exe,c:\windows\syswow64\*,Used for managing background intelligent transfer
+msiexec.exe,c:\windows\system32\*,Used by Windows to execute msi files
+msiexec.exe,c:\windows\syswow64\*,Used by Windows to execute msi files
+regsvcs.exe,c:\windows\system32\*,Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
+regsvcs.exe,c:\windows\syswow64\*,Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
+gpscript.exe,c:\windows\system32\*,Used by group policy to process scripts
+gpscript.exe,c:\windows\syswow64\*,Used by group policy to process scripts
+diskshadow.exe,c:\windows\system32\*,Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
+diskshadow.exe,c:\windows\syswow64\*,Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
+ieexec.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
+ieexec.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
+diantz.exe,c:\windows\system32\*,Binary that package existing files into a cabinet (.cab) file
+diantz.exe,c:\windows\syswow64\*,Binary that package existing files into a cabinet (.cab) file
+desktopimgdownldr.exe,c:\windows\system32\*,Windows binary used to configure lockscreen/desktop image
+appinstaller.exe,c:\program files\windowsapps\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe\*,Tool used for installation of AppX/MSIX applications on Windows 10
+sc.exe,c:\windows\system32\*,Used by Windows to manage services
+sc.exe,c:\windows\syswow64\*,Used by Windows to manage services
+replace.exe,c:\windows\system32\*,Used to replace file with another file
+replace.exe,c:\windows\syswow64\*,Used to replace file with another file
+schtasks.exe,c:\windows\system32\*,Schedule periodic tasks
+schtasks.exe,c:\windows\syswow64\*,Schedule periodic tasks
+microsoft.workflow.compiler.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,A utility included with .NET that is capable of compiling and executing C# or VB.net code.
+expand.exe,c:\windows\system32\*,Binary that expands one or more compressed files
+expand.exe,c:\windows\syswow64\*,Binary that expands one or more compressed files
+conhost.exe,c:\windows\system32\*,Console Window host
+bash.exe,c:\windows\system32\*,File used by Windows subsystem for Linux
+bash.exe,c:\windows\syswow64\*,File used by Windows subsystem for Linux
+pcwrun.exe,c:\windows\system32\*,Program Compatibility Wizard
+fltmc.exe,c:\windows\system32\*,Filter Manager Control Program used by Windows
+wmic.exe,c:\windows\system32\wbem\*,The WMI command-line (WMIC) utility provides a command-line interface for WMI
+wmic.exe,c:\windows\syswow64\wbem\*,The WMI command-line (WMIC) utility provides a command-line interface for WMI
+workfolders.exe,c:\windows\system32\*,Work Folders
+settingsynchost.exe,c:\windows\system32\*,Host Process for Setting Synchronization
+settingsynchost.exe,c:\windows\syswow64\*,Host Process for Setting Synchronization
+pktmon.exe,c:\windows\system32\*,Capture Network Packets on the windows 10 with October 2018 Update or later.
+pktmon.exe,c:\windows\syswow64\*,Capture Network Packets on the windows 10 with October 2018 Update or later.
+aspnet_compiler.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,ASP.NET Compilation Tool
+aspnet_compiler.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,ASP.NET Compilation Tool
+cscript.exe,c:\windows\system32\*,Binary used to execute scripts in Windows
+cscript.exe,c:\windows\syswow64\*,Binary used to execute scripts in Windows
+installutil.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
+installutil.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
+installutil.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
+installutil.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
+esentutl.exe,c:\windows\system32\*,Binary for working with Microsoft Joint Engine Technology (JET) database
+esentutl.exe,c:\windows\syswow64\*,Binary for working with Microsoft Joint Engine Technology (JET) database
+hh.exe,c:\windows\*,Binary used for processing chm files in Windows
+hh.exe,c:\windows\syswow64\*,Binary used for processing chm files in Windows
+findstr.exe,c:\windows\system32\*,"Write to ADS, discover, or download files with Findstr.exe"
+findstr.exe,c:\windows\syswow64\*,"Write to ADS, discover, or download files with Findstr.exe"
+verclsid.exe,c:\windows\system32\*,Used to verify a COM object before it is instantiated by Windows Explorer
+verclsid.exe,c:\windows\syswow64\*,Used to verify a COM object before it is instantiated by Windows Explorer
+certreq.exe,c:\windows\system32\*,Used for requesting and managing certificates
+certreq.exe,c:\windows\syswow64\*,Used for requesting and managing certificates
+csc.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Binary file used by .NET to compile C# code
+csc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Binary file used by .NET to compile C# code
+imewdbld.exe,c:\windows\system32\ime\shared\*,Microsoft IME Open Extended Dictionary Module
+presentationhost.exe,c:\windows\system32\*,File is used for executing Browser applications
+presentationhost.exe,c:\windows\syswow64\*,File is used for executing Browser applications
+shell32.dll,c:\windows\system32\*,Windows Shell Common Dll
+shell32.dll,c:\windows\syswow64\*,Windows Shell Common Dll
+zipfldr.dll,c:\windows\system32\*,Compressed Folder library
+zipfldr.dll,c:\windows\syswow64\*,Compressed Folder library
+desk.cpl,c:\windows\system32\*,Desktop Settings Control Panel
+desk.cpl,c:\windows\syswow64\*,Desktop Settings Control Panel
+comsvcs.dll,c:\windows\system32\*,COM+ Services
+setupapi.dll,c:\windows\system32\*,Windows Setup Application Programming Interface
+setupapi.dll,c:\windows\syswow64\*,Windows Setup Application Programming Interface
+mshtml.dll,c:\windows\system32\*,Microsoft HTML Viewer
+mshtml.dll,c:\windows\syswow64\*,Microsoft HTML Viewer
+advpack.dll,c:\windows\system32\*,Utility for installing software and drivers with rundll32.exe
+advpack.dll,c:\windows\syswow64\*,Utility for installing software and drivers with rundll32.exe
+pcwutl.dll,c:\windows\system32\*,Microsoft HTML Viewer
+pcwutl.dll,c:\windows\syswow64\*,Microsoft HTML Viewer
+shdocvw.dll,c:\windows\system32\*,Shell Doc Object and Control Library.
+shdocvw.dll,c:\windows\syswow64\*,Shell Doc Object and Control Library.
+ieframe.dll,c:\windows\system32\*,Internet Browser DLL for translating HTML code.
+ieframe.dll,c:\windows\syswow64\*,Internet Browser DLL for translating HTML code.
+dfshim.dll,c:\windows\microsoft.net\framework\v2.0.50727\*,ClickOnce engine in Windows used by .NET
+dfshim.dll,c:\windows\microsoft.net\framework64\v2.0.50727\*,ClickOnce engine in Windows used by .NET
+dfshim.dll,c:\windows\microsoft.net\framework\v4.0.30319\*,ClickOnce engine in Windows used by .NET
+dfshim.dll,c:\windows\microsoft.net\framework64\v4.0.30319\*,ClickOnce engine in Windows used by .NET
+url.dll,c:\windows\system32\*,Internet Shortcut Shell Extension DLL.
+url.dll,c:\windows\syswow64\*,Internet Shortcut Shell Extension DLL.
+ieadvpack.dll,c:\windows\system32\*,INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
+ieadvpack.dll,c:\windows\syswow64\*,INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
+syssetup.dll,c:\windows\system32\*,Windows NT System Setup
+syssetup.dll,c:\windows\syswow64\*,Windows NT System Setup
+winrm.vbs,c:\windows\system32\*,Script used for manage Windows RM settings
+winrm.vbs,c:\windows\syswow64\*,Script used for manage Windows RM settings
+manage-bde.wsf,c:\windows\system32\*,Script for managing BitLocker
+cl_mutexverifiers.ps1,c:\windows\diagnostics\system\windowsupdate\*,Proxy execution with CL_Mutexverifiers.ps1
+cl_mutexverifiers.ps1,c:\windows\diagnostics\system\audio\*,Proxy execution with CL_Mutexverifiers.ps1
+cl_mutexverifiers.ps1,c:\windows\diagnostics\system\video\*,Proxy execution with CL_Mutexverifiers.ps1
+cl_mutexverifiers.ps1,c:\windows\diagnostics\system\speech\*,Proxy execution with CL_Mutexverifiers.ps1
+pubprn.vbs,c:\windows\system32\printing_admin_scripts\en-us\*,Proxy execution with Pubprn.vbs
+pubprn.vbs,c:\windows\syswow64\printing_admin_scripts\en-us\*,Proxy execution with Pubprn.vbs
+pester.bat,c:\program files\windowspowershell\modules\pester\3.4.0\bin\*,Used as part of the Powershell pester
+pester.bat,c:\program files\windowspowershell\modules\pester\*\bin\*,Used as part of the Powershell pester
+cl_loadassembly.ps1,c:\windows\diagnostics\system\audio\*,PowerShell Diagnostic Script
+syncappvpublishingserver.vbs,c:\windows\system32\*,Script used related to app-v and publishing server
+cl_invocation.ps1,c:\windows\diagnostics\system\aero\*,Aero diagnostics script
+cl_invocation.ps1,c:\windows\diagnostics\system\audio\*,Aero diagnostics script
+cl_invocation.ps1,c:\windows\diagnostics\system\windowsupdate\*,Aero diagnostics script
+utilityfunctions.ps1,c:\windows\diagnostics\system\networking\*,PowerShell Diagnostic Script
+coregen.exe,c:\program files\microsoft silverlight\5.1.50918.0\*,"Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within ""C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight."
+coregen.exe,c:\program files (x86)\microsoft silverlight\5.1.50918.0\*,"Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within ""C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight."
+fsi.exe,c:\program files\dotnet\sdk\[sdk version]\fsharp\*,64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
+fsi.exe,c:\program files (x86)\microsoft visual studio\2019\professional\common7\ide\commonextensions\microsoft\fsharp\*,64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
+visualuiaverifynative.exe,c:\program files (x86)\windows kits\10\bin\[sdk version]\arm64\uiaverify\*,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
+visualuiaverifynative.exe,c:\program files (x86)\windows kits\10\bin\[sdk version]\x64\uiaverify\*,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
+visualuiaverifynative.exe,c:\program files (x86)\windows kits\10\bin\[sdk version]\uiaverify\*,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
+ntdsutil.exe,c:\windows\system32\*,Command line utility used to export Active Directory.
+sqltoolsps.exe,c:\program files (x86)\microsoft sql server\130\tools\binn\*,Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.
+dump64.exe,c:\program files (x86)\microsoft visual studio\installer\feedback\*,Memory dump tool that comes with Microsoft Visual Studio
+wsl.exe,c:\windows\system32\*,Windows subsystem for Linux executable
+csi.exe,c:\program files (x86)\microsoft visual studio\2017\community\msbuild\15.0\bin\roslyn\*,Command line interface included with Visual Studio.
+csi.exe,c:\program files (x86)\microsoft web tools\packages\microsoft.net.compilers.x.y.z\tools\*,Command line interface included with Visual Studio.
+mftrace.exe,c:\program files (x86)\windows kits\10\bin\10.0.16299.0\*,Trace log generation tool for Media Foundation Tools.
+mftrace.exe,c:\program files (x86)\windows kits\10\bin\*,Trace log generation tool for Media Foundation Tools.
+adplus.exe,c:\program files (x86)\windows kits\10\debuggers\x64\*,Debugging tool included with Windows Debugging Tools
+adplus.exe,c:\program files (x86)\windows kits\10\debuggers\x86\*,Debugging tool included with Windows Debugging Tools
+excel.exe,c:\program files (x86)\microsoft office 16\clientx86\root\office16\*,Microsoft Office binary
+excel.exe,c:\program files\microsoft office 16\clientx64\root\office16\*,Microsoft Office binary
+excel.exe,c:\program files (x86)\microsoft office\office16\*,Microsoft Office binary
+excel.exe,c:\program files\microsoft office\office16\*,Microsoft Office binary
+excel.exe,c:\program files (x86)\microsoft office 15\clientx86\root\office15\*,Microsoft Office binary
+excel.exe,c:\program files\microsoft office 15\clientx64\root\office15\*,Microsoft Office binary
+excel.exe,c:\program files (x86)\microsoft office\office15\*,Microsoft Office binary
+excel.exe,c:\program files\microsoft office\office15\*,Microsoft Office binary
+excel.exe,c:\program files (x86)\microsoft office 14\clientx86\root\office14\*,Microsoft Office binary
+excel.exe,c:\program files\microsoft office 14\clientx64\root\office14\*,Microsoft Office binary
+excel.exe,c:\program files (x86)\microsoft office\office14\*,Microsoft Office binary
+excel.exe,c:\program files\microsoft office\office14\*,Microsoft Office binary
+excel.exe,c:\program files (x86)\microsoft office\office12\*,Microsoft Office binary
+excel.exe,c:\program files\microsoft office\office12\*,Microsoft Office binary
+dotnet.exe,c:\program files\dotnet\*,dotnet.exe comes with .NET Framework
+sqlps.exe,c:\program files (x86)\microsoft sql server\100\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
+sqlps.exe,c:\program files (x86)\microsoft sql server\110\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
+sqlps.exe,c:\program files (x86)\microsoft sql server\120\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
+sqlps.exe,c:\program files (x86)\microsoft sql server\130\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
+sqlps.exe,c:\program files (x86)\microsoft sql server\150\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
+acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\x86\accchecker\*,Verifies UI accessibility requirements
+acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\x64\accchecker\*,Verifies UI accessibility requirements
+acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\arm\accchecker\*,Verifies UI accessibility requirements
+acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\arm64\accchecker\*,Verifies UI accessibility requirements
+powerpnt.exe,c:\program files (x86)\microsoft office 16\clientx86\root\office16\*,Microsoft Office binary.
+powerpnt.exe,c:\program files\microsoft office 16\clientx64\root\office16\*,Microsoft Office binary.
+powerpnt.exe,c:\program files (x86)\microsoft office\office16\*,Microsoft Office binary.
+powerpnt.exe,c:\program files\microsoft office\office16\*,Microsoft Office binary.
+powerpnt.exe,c:\program files (x86)\microsoft office 15\clientx86\root\office15\*,Microsoft Office binary.
+powerpnt.exe,c:\program files\microsoft office 15\clientx64\root\office15\*,Microsoft Office binary.
+powerpnt.exe,c:\program files (x86)\microsoft office\office15\*,Microsoft Office binary.
+powerpnt.exe,c:\program files\microsoft office\office15\*,Microsoft Office binary.
+powerpnt.exe,c:\program files (x86)\microsoft office 14\clientx86\root\office14\*,Microsoft Office binary.
+powerpnt.exe,c:\program files\microsoft office 14\clientx64\root\office14\*,Microsoft Office binary.
+powerpnt.exe,c:\program files (x86)\microsoft office\office14\*,Microsoft Office binary.
+powerpnt.exe,c:\program files\microsoft office\office14\*,Microsoft Office binary.
+powerpnt.exe,c:\program files (x86)\microsoft office\office12\*,Microsoft Office binary.
+powerpnt.exe,c:\program files\microsoft office\office12\*,Microsoft Office binary.
+sqldumper.exe,c:\program files\microsoft sql server\90\shared\*,Debugging utility included with Microsoft SQL.
+sqldumper.exe,c:\program files (x86)\microsoft office\root\vfs\programfilesx86\microsoft analysis\as oledb\140\*,Debugging utility included with Microsoft SQL.
+remote.exe,c:\program files (x86)\windows kits\10\debuggers\x64\*,Debugging tool included with Windows Debugging Tools
+remote.exe,c:\program files (x86)\windows kits\10\debuggers\x86\*,Debugging tool included with Windows Debugging Tools
+appvlp.exe,c:\program files\microsoft office\root\client\*,Application Virtualization Utility Included with Microsoft Office 2016
+appvlp.exe,c:\program files (x86)\microsoft office\root\client\*,Application Virtualization Utility Included with Microsoft Office 2016
+agentexecutor.exe,c:\program files (x86)\*,Intune Management Extension included on Intune Managed Devices
+dxcap.exe,c:\windows\system32\*,DirectX diagnostics/debugger included with Visual Studio.
+dxcap.exe,c:\windows\syswow64\*,DirectX diagnostics/debugger included with Visual Studio.
+cdb.exe,c:\program files (x86)\windows kits\10\debuggers\x64\*,Debugging tool included with Windows Debugging Tools.
+cdb.exe,c:\program files (x86)\windows kits\10\debuggers\x86\*,Debugging tool included with Windows Debugging Tools.
+defaultpack.exe,c:\program files (x86)\microsoft\defaultpack\*,This binary can be downloaded along side multiple software downloads on the microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider.
+devtoolslauncher.exe,c:\windows\system32\*,Binary will execute specified binary. Part of VS/VScode installation.
+vsiisexelauncher.exe,c:\program files (x86)\microsoft visual studio\2019\community\common7\ide\extensions\microsoft\web tools\projectsystem\*,Binary will execute specified binary. Part of VS/VScode installation.
+winword.exe,c:\program files\microsoft office\root\office16\*,Microsoft Office binary
+winword.exe,c:\program files (x86)\microsoft office 16\clientx86\root\office16\*,Microsoft Office binary
+winword.exe,c:\program files\microsoft office 16\clientx64\root\office16\*,Microsoft Office binary
+winword.exe,c:\program files (x86)\microsoft office\office16\*,Microsoft Office binary
+winword.exe,c:\program files\microsoft office\office16\*,Microsoft Office binary
+winword.exe,c:\program files (x86)\microsoft office 15\clientx86\root\office15\*,Microsoft Office binary
+winword.exe,c:\program files\microsoft office 15\clientx64\root\office15\*,Microsoft Office binary
+winword.exe,c:\program files (x86)\microsoft office\office15\*,Microsoft Office binary
+winword.exe,c:\program files\microsoft office\office15\*,Microsoft Office binary
+winword.exe,c:\program files (x86)\microsoft office 14\clientx86\root\office14\*,Microsoft Office binary
+winword.exe,c:\program files\microsoft office 14\clientx64\root\office14\*,Microsoft Office binary
+winword.exe,c:\program files (x86)\microsoft office\office14\*,Microsoft Office binary
+winword.exe,c:\program files\microsoft office\office14\*,Microsoft Office binary
+winword.exe,c:\program files (x86)\microsoft office\office12\*,Microsoft Office binary
+winword.exe,c:\program files\microsoft office\office12\*,Microsoft Office binary
+fsianycpu.exe,c:\program files (x86)\microsoft visual studio\2019\professional\common7\ide\commonextensions\microsoft\fsharp\*,32/64-bit FSharp (F#) Interpreter included with Visual Studio.
+vsjitdebugger.exe,c:\windows\system32\*,Just-In-Time (JIT) debugger included with Visual Studio
+wfc.exe,c:\program files (x86)\microsoft sdks\windows\v10.0a\bin\netfx 4.8 tools\*,The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).
+msdeploy.exe,c:\program files (x86)\iis\microsoft web deploy v3\*,Microsoft tool used to deploy Web Applications.