From b2ddf3a6c8eabc0891c6e785e130a8116335a353 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 14 Oct 2022 11:38:42 -0600
Subject: [PATCH 1/5] updates

---
 .../disabling_firewall_with_netsh.yml         |  2 +-
 .../endpoint/processes_launching_netsh.yml    |  9 ++++-----
 ...rocesses_run_from_unexpected_locations.yml | 20 +++++++++++--------
 3 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml
index 64d2057372..12564a5e75 100644
--- a/detections/endpoint/disabling_firewall_with_netsh.yml
+++ b/detections/endpoint/disabling_firewall_with_netsh.yml
@@ -3,7 +3,7 @@ id: 6860a62c-9203-11eb-9e05-acde48001122
 version: 2
 date: '2021-03-31'
 author: Teoderick Contreras, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: This search is to identifies suspicious firewall disabling using netsh
diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml
index 46770ffccf..dbaee7e921 100644
--- a/detections/endpoint/processes_launching_netsh.yml
+++ b/detections/endpoint/processes_launching_netsh.yml
@@ -3,7 +3,7 @@ id: b89919ed-fe5f-492c-b139-95dbb162040e
 version: 4
 date: '2021-09-16'
 author: Michael Haag, Josef Kuepker, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: This search looks for processes launching netsh.exe. Netsh is a command-line
@@ -42,11 +42,10 @@ tags:
   - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/atomic_red_team/windows-sysmon.log
-  impact: 60
+  impact: 20
   kill_chain_phases:
   - Actions on Objectives
-  message: A process $process_name$ that tries to execute netsh commandline $process$
-    in host $dest$
+  message: A process $process_name$ has launched netsh with command-line $process$ on $dest$.
   mitre_attack_id:
   - T1562.004
   - T1562
@@ -74,7 +73,7 @@ tags:
   - Processes.process_name
   - Processes.user
   - Processes.dest
-  risk_score: 42
+  risk_score: 14
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
index f17fcdf50b..d7991a1905 100644
--- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml
+++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
@@ -3,7 +3,7 @@ id: a34aae96-ccf8-4aef-952c-3ea21444444d
 version: 6
 date: '2020-12-08'
 author: David Dorsey, Michael Haag, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: 'This search looks for system processes that typically execute from `C:\Windows\System32\`
@@ -40,17 +40,17 @@ tags:
   asset_type: Endpoint
   cis20:
   - CIS 8
-  confidence: 70
+  confidence: 50
   context:
   - Source:Endpoint
   - Stage:Initial Access
   - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log
-  impact: 70
+  impact: 60
   kill_chain_phases:
   - Actions on Objectives
-  message: System process running from unexpected location on $dest$
+  message: A System process $process_name$ is running from $process_path$ on $dest$, potentially non-standard.
   mitre_attack_id:
   - T1036
   - T1036.003
@@ -62,10 +62,14 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: Processes.process_name
+  - name: process_name
     type: Process
     role:
-    - Attacker
+    - Child Process
+  - name: process_path
+    type: Other
+    role:
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -79,7 +83,7 @@ tags:
   - Processes.process_id
   - Processes.parent_process_name
   - Processes.process_hash
-  risk_score: 49
+  risk_score: 30
   security_domain: endpoint
   supported_tas:
-  - Splunk_TA_microsoft_sysmon
+  - Splunk_TA_microsoft_sysmon
\ No newline at end of file

From 00433d62d7ce30c5a23eabeb46f9e03f00f15981 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Sat, 15 Oct 2022 06:21:49 -0600
Subject: [PATCH 2/5] Update
 executables_or_script_creation_in_suspicious_path.yml

---
 .../executables_or_script_creation_in_suspicious_path.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
index 7aab201436..9934363177 100644
--- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -3,7 +3,7 @@ id: a7e3f0f0-ae42-11eb-b245-acde48001122
 version: 1
 date: '2021-05-06'
 author: Teoderick Contreras, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: This analytic will identify suspicious executable or scripts (known file
@@ -47,13 +47,13 @@ tags:
   - Brute Ratel C4
   - AgentTesla
   automated_detection_testing: passed
-  confidence: 70
+  confidence: 50
   context:
   - Source:Endpoint
   - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
-  impact: 80
+  impact: 40
   kill_chain_phases:
   - Exploitation
   message: Suspicious executable or scripts with file name $file_name$, $file_path$
@@ -85,6 +85,6 @@ tags:
   - Filesystem.process_id
   - Filesystem.file_name
   - Filesystem.user
-  risk_score: 56
+  risk_score: 20
   security_domain: endpoint
   asset_type: Endpoint

From ac0593d1a0676751fcf3c54dcc28714a7376322d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Sat, 15 Oct 2022 06:28:43 -0600
Subject: [PATCH 3/5] Update powershell_using_memory_as_backing_store.yml

---
 .../endpoint/powershell_using_memory_as_backing_store.yml     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml
index 8659f09b14..09d539747f 100644
--- a/detections/endpoint/powershell_using_memory_as_backing_store.yml
+++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml
@@ -39,8 +39,8 @@ tags:
   impact: 50
   kill_chain_phases:
   - Exploitation
-  message: A suspicious powershell script contains memorystream command in $ScriptBlockText$
-    as new object backstore with EventCode $EventCode$ in host $Computer$
+  message: A PowerShell script contains memorystream command in $ScriptBlockText$
+    as new object backstore with EventCode $EventCode$ on host $Computer$.
   mitre_attack_id:
   - T1059.001
   - T1059

From 0fd8ed68f56f375401ca4bb722bdd469489afd6b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 24 Oct 2022 09:55:43 -0600
Subject: [PATCH 4/5] Update wmi_recon_running_process_or_services.yml

---
 .../endpoint/wmi_recon_running_process_or_services.yml    | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml
index 76932413e5..d1cb818c60 100644
--- a/detections/endpoint/wmi_recon_running_process_or_services.yml
+++ b/detections/endpoint/wmi_recon_running_process_or_services.yml
@@ -3,7 +3,7 @@ id: b5cd5526-cce7-11eb-b3bd-acde48001122
 version: 2
 date: '2022-05-02'
 author: Teoderick Contreras, Splunk
-type: TTP
+type: Anomaly
 datamodel: []
 description: The following analytic identifies suspicious PowerShell script execution
   via EventCode 4104, where WMI is performing an event query looking for running processes
@@ -18,7 +18,7 @@ search: '`powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBloc
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: network administrator may used this command for checking purposes
+known_false_positives: Network administrator may used this command for checking purposes
 references:
 - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
@@ -34,7 +34,7 @@ tags:
   - Stage:Recon
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log
-  impact: 30
+  impact: 20
   kill_chain_phases:
   - Reconnaissance
   message: Suspicious powerShell script execution by $user$ on $Computer$ via
@@ -62,6 +62,6 @@ tags:
   - Computer
   - UserID
   - EventCode
-  risk_score: 30
+  risk_score: 20
   security_domain: endpoint
   asset_type: Endpoint

From bdec923237a0622489960e70fc6a5123bbddb7bd Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 24 Oct 2022 10:09:53 -0600
Subject: [PATCH 5/5] Update suspicious_reg_exe_process.yml

---
 detections/endpoint/suspicious_reg_exe_process.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml
index 8eb801fb52..aea9e3c110 100644
--- a/detections/endpoint/suspicious_reg_exe_process.yml
+++ b/detections/endpoint/suspicious_reg_exe_process.yml
@@ -3,7 +3,7 @@ id: a6b3ab4e-dd77-4213-95fa-fc94701995e0
 version: 4
 date: '2020-07-22'
 author: David Dorsey, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: This search looks for reg.exe being launched from a command prompt not