Branch was auto-updated.

detections/endpoint/disabling_firewall_with_netsh.yml

@@ -3,7 +3,7 @@ id: 6860a62c-9203-11eb-9e05-acde48001122
 version: 2
 date: '2021-03-31'
 author: Teoderick Contreras, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: This search is to identifies suspicious firewall disabling using netsh

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -3,7 +3,7 @@ id: a7e3f0f0-ae42-11eb-b245-acde48001122
 version: 1
 date: '2021-05-06'
 author: Teoderick Contreras, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: This analytic will identify suspicious executable or scripts (known file
@@ -47,13 +47,13 @@ tags:
   - Brute Ratel C4
   - AgentTesla
   automated_detection_testing: passed
-  confidence: 70
+  confidence: 50
   context:
   - Source:Endpoint
   - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
-  impact: 80
+  impact: 40
   kill_chain_phases:
   - Exploitation
   message: Suspicious executable or scripts with file name $file_name$, $file_path$
@@ -85,6 +85,6 @@ tags:
   - Filesystem.process_id
   - Filesystem.file_name
   - Filesystem.user
-  risk_score: 56
+  risk_score: 20
   security_domain: endpoint
   asset_type: Endpoint

detections/endpoint/powershell_using_memory_as_backing_store.yml

@@ -39,8 +39,8 @@ tags:
   impact: 50
   kill_chain_phases:
   - Exploitation
-  message: A suspicious powershell script contains memorystream command in $ScriptBlockText$
-    as new object backstore with EventCode $EventCode$ in host $Computer$
+  message: A PowerShell script contains memorystream command in $ScriptBlockText$
+    as new object backstore with EventCode $EventCode$ on host $Computer$.
   mitre_attack_id:
   - T1059.001
   - T1059

detections/endpoint/processes_launching_netsh.yml

@@ -3,7 +3,7 @@ id: b89919ed-fe5f-492c-b139-95dbb162040e
 version: 4
 date: '2021-09-16'
 author: Michael Haag, Josef Kuepker, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: This search looks for processes launching netsh.exe. Netsh is a command-line
@@ -42,11 +42,10 @@ tags:
   - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/atomic_red_team/windows-sysmon.log
-  impact: 60
+  impact: 20
   kill_chain_phases:
   - Actions on Objectives
-  message: A process $process_name$ that tries to execute netsh commandline $process$
-    in host $dest$
+  message: A process $process_name$ has launched netsh with command-line $process$ on $dest$.
   mitre_attack_id:
   - T1562.004
   - T1562
@@ -74,7 +73,7 @@ tags:
   - Processes.process_name
   - Processes.user
   - Processes.dest
-  risk_score: 42
+  risk_score: 14
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon

detections/endpoint/suspicious_reg_exe_process.yml

@@ -3,7 +3,7 @@ id: a6b3ab4e-dd77-4213-95fa-fc94701995e0
 version: 4
 date: '2020-07-22'
 author: David Dorsey, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: This search looks for reg.exe being launched from a command prompt not

detections/endpoint/system_processes_run_from_unexpected_locations.yml

@@ -3,7 +3,7 @@ id: a34aae96-ccf8-4aef-952c-3ea21444444d
 version: 6
 date: '2020-12-08'
 author: David Dorsey, Michael Haag, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: 'This search looks for system processes that typically execute from `C:\Windows\System32\`
@@ -40,17 +40,17 @@ tags:
   asset_type: Endpoint
   cis20:
   - CIS 8
-  confidence: 70
+  confidence: 50
   context:
   - Source:Endpoint
   - Stage:Initial Access
   - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log
-  impact: 70
+  impact: 60
   kill_chain_phases:
   - Actions on Objectives
-  message: System process running from unexpected location on $dest$
+  message: A System process $process_name$ is running from $process_path$ on $dest$, potentially non-standard.
   mitre_attack_id:
   - T1036
   - T1036.003
@@ -62,10 +62,14 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: Processes.process_name
+  - name: process_name
     type: Process
     role:
-    - Attacker
+    - Child Process
+  - name: process_path
+    type: Other
+    role:
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -79,7 +83,7 @@ tags:
   - Processes.process_id
   - Processes.parent_process_name
   - Processes.process_hash
-  risk_score: 49
+  risk_score: 30
   security_domain: endpoint
   supported_tas:
-  - Splunk_TA_microsoft_sysmon
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/wmi_recon_running_process_or_services.yml

@@ -3,7 +3,7 @@ id: b5cd5526-cce7-11eb-b3bd-acde48001122
 version: 2
 date: '2022-05-02'
 author: Teoderick Contreras, Splunk
-type: TTP
+type: Anomaly
 datamodel: []
 description: The following analytic identifies suspicious PowerShell script execution
   via EventCode 4104, where WMI is performing an event query looking for running processes
@@ -18,7 +18,7 @@ search: '`powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBloc
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: network administrator may used this command for checking purposes
+known_false_positives: Network administrator may used this command for checking purposes
 references:
 - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
@@ -34,7 +34,7 @@ tags:
   - Stage:Recon
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log
-  impact: 30
+  impact: 20
   kill_chain_phases:
   - Reconnaissance
   message: Suspicious powerShell script execution by $user$ on $Computer$ via
@@ -62,6 +62,6 @@ tags:
   - Computer
   - UserID
   - EventCode
-  risk_score: 30
+  risk_score: 20
   security_domain: endpoint
   asset_type: Endpoint