From fd88c8876281e65bbaf30669fef23c6ae879283e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 19 Aug 2022 14:37:29 -0600
Subject: [PATCH 01/14] Hijack Libraries

---
 detections/endpoint/living_off_the_land.yml   | 12 +--
 ...indows_dll_search_order_hijacking_hunt.yml | 80 +++++++++++++++++++
 ...earch_order_hijacking_hunt_with_sysmon.yml | 80 +++++++++++++++++++
 ...s_dll_search_order_hijacking_hunt.test.yml | 13 +++
 ..._order_hijacking_hunt_with_sysmon.test.yml | 13 +++
 5 files changed, 192 insertions(+), 6 deletions(-)
 create mode 100644 detections/endpoint/windows_dll_search_order_hijacking_hunt.yml
 create mode 100644 detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
 create mode 100644 tests/endpoint/windows_dll_search_order_hijacking_hunt.test.yml
 create mode 100644 tests/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.test.yml

diff --git a/detections/endpoint/living_off_the_land.yml b/detections/endpoint/living_off_the_land.yml
index 6f2cb9d35d..3c5f684833 100644
--- a/detections/endpoint/living_off_the_land.yml
+++ b/detections/endpoint/living_off_the_land.yml
@@ -1,18 +1,18 @@
 name: Living Off The Land
 id: 1be30d80-3a39-4df9-9102-64a467b24abc
-version: 1
-date: '2022-07-08'
+version: 2
+date: '2022-08-19'
 author: Michael Haag, Splunk
 type: Correlation
 datamodel:
   - Risk
 description: The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior. 
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source 
+search: '| tstats `security_content_summariesonly` count as risk_event_count, sum(All_Risk.calculated_risk_score) as risk_score, min(_time) as firstTime max(_time) as lastTime, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object, All_Risk.risk_object_type, source 
   | `drop_dm_object_name(All_Risk)` 
+  | stats  values(source) as source, sum(risk_score) as risk_score, sum(risk_event_count) as risk_event_count, values(annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic min(firstTime) as firstTime max(lastTime) as lastTime, values(annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count dc(source) as source_count by risk_object, risk_object_type
+  | where source_count >= 5
   | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | stats  values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics dc(source) as distinct_detection_name by risk_object
-  | where distinct_detection_name >= 2
+  | `security_content_ctime(lastTime)`
   | `living_off_the_land_filter`'
 how_to_implement: To implement this correlation search a user needs to enable all
   detections in the Living Off The Land Analytic Story and confirm it is generating risk events.
diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml
new file mode 100644
index 0000000000..13a1189023
--- /dev/null
+++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml
@@ -0,0 +1,80 @@
+name: Windows DLL Search Order Hijacking Hunt
+id: 79c7d0fc-60c7-41be-a616-ccda752efe89
+version: 1
+date: '2022-08-18'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic is an experimental query built against a accidental feature using the latest Sysmon TA 3.0 (https://splunkbase.splunk.com/app/5709/) which maps the module load (ImageLoaded) to process_name. 
+  This analytic will deprecate once this is fixed.
+  This hunting analytic identifies known libraries in Windows that may be used in a DLL search order hijack or DLL Sideloading setting. This may require recompiling the DLL, moving the DLL or moving the vulnerable process. The query looks for any running out of system32 or syswow64. Some libraries natively run out of other application paths and will need to be added to the exclusion as needed.
+  The lookup is comprised of Microsoft native libraries identified within the Hijacklibs.net project. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime values(Processes.process_name) as process_name from datamodel=Endpoint.Processes where Processes.dest!=unknown
+  Processes.user!=unknown NOT (Processes.process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*"))  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process_path   
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `drop_dm_object_name(Processes)` 
+  | lookup hijacklibs library AS process_name OUTPUT islibrary | search islibrary = True
+  | rename parent_process_name as "Process Name" process_name AS ImageLoaded process_path AS Module_Path
+  | `windows_dll_search_order_hijacking_hunt_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. This may only with with Sysmon data and the Sysmon TA. Your mileage may vary.
+known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed.
+references:
+  - https://hijacklibs.net
+tags:
+  analytic_story:
+  - Living Off The Land
+  - Windows Defense Evasion Tactics
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 10
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log
+  impact: 10
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform DLL search order hijacking.
+  mitre_attack_id:
+  - T1574.001
+  - T1574
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process_name
+  - Processes.process_name 
+  - Processes.process_path   
+  risk_score: 1
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
new file mode 100644
index 0000000000..e8806aeb63
--- /dev/null
+++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
@@ -0,0 +1,80 @@
+name: Windows DLL Search Order Hijacking Hunt with Sysmon
+id: 79c7d1fc-64c7-91be-a616-ccda752efe81
+version: 1
+date: '2022-08-18'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic is an experimental query built against a accidental feature using the latest Sysmon TA 3.0 (https://splunkbase.splunk.com/app/5709/) which maps the module load (ImageLoaded) to process_name. 
+  This analytic will deprecate once this is fixed.
+  This hunting analytic identifies known libraries in Windows that may be used in a DLL search order hijack or DLL Sideloading setting. This may require recompiling the DLL, moving the DLL or moving the vulnerable process. The query looks for any running out of system32 or syswow64. Some libraries natively run out of other application paths and will need to be added to the exclusion as needed.
+  The lookup is comprised of Microsoft native libraries identified within the Hijacklibs.net project. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime values(Processes.process_name) as process_name from datamodel=Endpoint.Processes where Processes.dest!=unknown
+  Processes.user!=unknown NOT (Processes.process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*"))  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process_path   
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `drop_dm_object_name(Processes)` 
+  | lookup hijacklibs library AS process_name OUTPUT islibrary | search islibrary = True
+  | rename parent_process_name as "Process Name" process_name AS ImageLoaded process_path AS Module_Path
+  | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`'
+how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed.
+references:
+  - https://hijacklibs.net
+tags:
+  analytic_story:
+  - Living Off The Land
+  - Windows Defense Evasion Tactics
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 10
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log
+  impact: 10
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform DLL search order hijacking.
+  mitre_attack_id:
+  - T1574.001
+  - T1574
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process_name
+  - Processes.process_name 
+  - Processes.process_path   
+  risk_score: 1
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_dll_search_order_hijacking_hunt.test.yml b/tests/endpoint/windows_dll_search_order_hijacking_hunt.test.yml
new file mode 100644
index 0000000000..e7e03491e5
--- /dev/null
+++ b/tests/endpoint/windows_dll_search_order_hijacking_hunt.test.yml
@@ -0,0 +1,13 @@
+name: Windows DLL Search Order Hijacking Hunt Unit Test
+tests:
+- name: Windows DLL Search Order Hijacking Hunt
+  file: endpoint/windows_dll_search_order_hijacking_hunt.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.test.yml b/tests/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.test.yml
new file mode 100644
index 0000000000..bda6772045
--- /dev/null
+++ b/tests/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.test.yml
@@ -0,0 +1,13 @@
+name: Windows DLL Search Order Hijacking Hunt with Sysmon Unit Test
+tests:
+- name: Windows DLL Search Order Hijacking Hunt with Sysmon
+  file: endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 416ddb5fa8a1974b2a65daff3e70d18db965130c Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 19 Aug 2022 14:40:01 -0600
Subject: [PATCH 02/14] lookup 1

---
 lookups/hijacklibs.csv | 347 +++++++++++++++++++++++++++++++++++++++++
 lookups/hijacklibs.yml |   7 +
 2 files changed, 354 insertions(+)
 create mode 100644 lookups/hijacklibs.csv
 create mode 100644 lookups/hijacklibs.yml

diff --git a/lookups/hijacklibs.csv b/lookups/hijacklibs.csv
new file mode 100644
index 0000000000..058c68f5fc
--- /dev/null
+++ b/lookups/hijacklibs.csv
@@ -0,0 +1,347 @@
+library,islibrary
+outllib.dll,TRUE
+iviewers.dll,TRUE
+hha.dll,TRUE
+aclui.dll,TRUE
+xwtpw32.dll,TRUE
+xwizards.dll,TRUE
+xolehlp.dll,TRUE
+xmllite.dll,TRUE
+wwapi.dll,TRUE
+wwancfg.dll,TRUE
+wtsapi32.dll,TRUE
+wshelper.dll,TRUE
+wshbth.dll,TRUE
+wpdshext.dll,TRUE
+wofutil.dll,TRUE
+wmsgapi.dll,TRUE
+wmpdui.dll,TRUE
+wmiutils.dll,TRUE
+wmidcom.dll,TRUE
+wmiclnt.dll,TRUE
+wlidprov.dll,TRUE
+wldp.dll,TRUE
+wlbsctrl.dll,TRUE
+wlancfg.dll,TRUE
+wlanapi.dll,TRUE
+wkscli.dll,TRUE
+winsta.dll,TRUE
+winsqlite3.dll,TRUE
+winrnr.dll,TRUE
+winnsi.dll,TRUE
+winmm.dll,TRUE
+winmde.dll,TRUE
+winipsec.dll,TRUE
+wininet.dll,TRUE
+winhttp.dll,TRUE
+windowsudk.shellcommon.dll,TRUE
+windowsperformancerecordercontrol.dll,TRUE
+windowscodecsext.dll,TRUE
+windowscodecs.dll,TRUE
+windows.storage.search.dll,TRUE
+windows.storage.dll,TRUE
+winbrand.dll,TRUE
+wimgapi.dll,TRUE
+whhelper.dll,TRUE
+wevtapi.dll,TRUE
+wer.dll,TRUE
+wecapi.dll,TRUE
+webservices.dll,TRUE
+wdscore.dll,TRUE
+wdi.dll,TRUE
+wcnnetsh.dll,TRUE
+wcmapi.dll,TRUE
+wbemsvc.dll,TRUE
+wbemprox.dll,TRUE
+vsstrace.dll,TRUE
+vssapi.dll,TRUE
+virtdisk.dll,TRUE
+vaultcli.dll,TRUE
+uxtheme.dll,TRUE
+uxinit.dll,TRUE
+utildll.dll,TRUE
+userenv.dll,TRUE
+upshared.dll,TRUE
+updatepolicy.dll,TRUE
+uiribbon.dll,TRUE
+uireng.dll,TRUE
+uiautomationcore.dll,TRUE
+uianimation.dll,TRUE
+twinui.appcore.dll,TRUE
+twinapi.dll,TRUE
+twext.dll,TRUE
+ttdrecord.dll,TRUE
+tsworkspace.dll,TRUE
+tquery.dll,TRUE
+timesync.dll,TRUE
+tdh.dll,TRUE
+tbs.dll,TRUE
+tapi32.dll,TRUE
+systemsettingsthresholdadminflowui.dll,TRUE
+sxshared.dll,TRUE
+structuredquery.dll,TRUE
+staterepository.core.dll,TRUE
+ssshim.dll,TRUE
+sspicli.dll,TRUE
+ssp_isv.exe_rsaenh.dll,TRUE
+ssp.exe_rsaenh.dll,TRUE
+srvcli.dll,TRUE
+srpapi.dll,TRUE
+srcore.dll,TRUE
+srclient.dll,TRUE
+sppc.dll,TRUE
+spp.dll,TRUE
+spectrumsyncclient.dll,TRUE
+snmpapi.dll,TRUE
+slc.dll,TRUE
+shell32.dll,TRUE
+secur32.dll,TRUE
+schedcli.dll,TRUE
+scecli.dll,TRUE
+scansetting.dll,TRUE
+sas.dll,TRUE
+sapi_onecore.dll,TRUE
+samlib.dll,TRUE
+samcli.dll,TRUE
+rtworkq.dll,TRUE
+rtutils.dll,TRUE
+rsaenh.dll,TRUE
+rpcnsh.dll,TRUE
+rmclient.dll,TRUE
+resutils.dll,TRUE
+resetengine.dll,TRUE
+reseteng.dll,TRUE
+regapi.dll,TRUE
+reagent.dll,TRUE
+rasmontr.dll,TRUE
+rasman.dll,TRUE
+rasgcw.dll,TRUE
+rasapi32.dll,TRUE
+radcui.dll,TRUE
+puiapi.dll,TRUE
+prvdmofcomp.dll,TRUE
+propsys.dll,TRUE
+printui.dll,TRUE
+polstore.dll,TRUE
+policymanager.dll,TRUE
+pnrpnsp.dll,TRUE
+pla.dll,TRUE
+peerdistsh.dll,TRUE
+pdh.dll,TRUE
+pcaui.dll,TRUE
+p9np.dll,TRUE
+p2pnetsh.dll,TRUE
+p2p.dll,TRUE
+osuninst.dll,TRUE
+osksupport.dll,TRUE
+osbaseln.dll,TRUE
+onex.dll,TRUE
+omadmapi.dll,TRUE
+oleacc.dll,TRUE
+oci.dll,TRUE
+ntshrui.dll,TRUE
+ntmarta.dll,TRUE
+ntlmshared.dll,TRUE
+ntlanman.dll,TRUE
+ntdsapi.dll,TRUE
+nshwfp.dll,TRUE
+nshipsec.dll,TRUE
+nshhttp.dll,TRUE
+npmproxy.dll,TRUE
+nlansp_c.dll,TRUE
+nlaapi.dll,TRUE
+ninput.dll,TRUE
+newdev.dll,TRUE
+networkexplorer.dll,TRUE
+netutils.dll,TRUE
+nettrace.dll,TRUE
+netshell.dll,TRUE
+netsetupapi.dll,TRUE
+netprofm.dll,TRUE
+netplwiz.dll,TRUE
+netiohlp.dll,TRUE
+netid.dll,TRUE
+ndfapi.dll,TRUE
+ncrypt.dll,TRUE
+napinsp.dll,TRUE
+mtxclu.dll,TRUE
+msxml3.dll,TRUE
+mswsock.dll,TRUE
+mswb7.dll,TRUE
+msutb.dll,TRUE
+mstracer.dll,TRUE
+msi.dll,TRUE
+msftedit.dll,TRUE
+msdtctm.dll,TRUE
+msdrm.dll,TRUE
+msctfmonitor.dll,TRUE
+msctf.dll,TRUE
+mscoree.dll,TRUE
+mscms.dll,TRUE
+msacm32.dll,TRUE
+mrmcorer.dll,TRUE
+mpsvc.dll,TRUE
+mprapi.dll,TRUE
+mpr.dll,TRUE
+mpclient.dll,TRUE
+mobilenetworking.dll,TRUE
+mmdevapi.dll,TRUE
+mlang.dll,TRUE
+miutils.dll,TRUE
+mintdh.dll,TRUE
+midimap.dll,TRUE
+mi.dll,TRUE
+mfplat.dll,TRUE
+mfcore.dll,TRUE
+mdmdiagnostics.dll,TRUE
+mapistub.dll,TRUE
+maintenanceui.dll,TRUE
+magnification.dll,TRUE
+lpksetupproxyserv.dll,TRUE
+logoncontroller.dll,TRUE
+logoncli.dll,TRUE
+loadperf.dll,TRUE
+linkinfo.dll,TRUE
+licensingdiagspp.dll,TRUE
+licensemanagerapi.dll,TRUE
+ktmw32.dll,TRUE
+ksuser.dll,TRUE
+kdstub.dll,TRUE
+joinutil.dll,TRUE
+iumbase.dll,TRUE
+isv.exe_rsaenh.dll,TRUE
+iscsium.dll,TRUE
+iscsidsc.dll,TRUE
+iri.dll,TRUE
+iphlpapi.dll,TRUE
+inproclogger.dll,TRUE
+ifmon.dll,TRUE
+iertutil.dll,TRUE
+iedkcs32.dll,TRUE
+ieadvpack.dll,TRUE
+idstore.dll,TRUE
+httpapi.dll,TRUE
+hnetmon.dll,TRUE
+hid.dll,TRUE
+getuname.dll,TRUE
+fxstiff.dll,TRUE
+fxsst.dll,TRUE
+fxsapi.dll,TRUE
+fwpuclnt.dll,TRUE
+fwpolicyiomgr.dll,TRUE
+fwcfg.dll,TRUE
+fwbase.dll,TRUE
+fveapi.dll,TRUE
+fltlib.dll,TRUE
+flightsettings.dll,TRUE
+firewallapi.dll,TRUE
+fhsvcctl.dll,TRUE
+fhcfg.dll,TRUE
+feclient.dll,TRUE
+fddevquery.dll,TRUE
+faultrep.dll,TRUE
+fastprox.dll,TRUE
+explorerframe.dll,TRUE
+execmodelproxy.dll,TRUE
+esent.dll,TRUE
+efsutil.dll,TRUE
+efsadu.dll,TRUE
+edputil.dll,TRUE
+eappprxy.dll,TRUE
+eappcfg.dll,TRUE
+dynamoapi.dll,TRUE
+dxva2.dll,TRUE
+dxgi.dll,TRUE
+dwrite.dll,TRUE
+dwmcore.dll,TRUE
+dwmapi.dll,TRUE
+dusmapi.dll,TRUE
+duser.dll,TRUE
+dui70.dll,TRUE
+dsrole.dll,TRUE
+dsreg.dll,TRUE
+dsparse.dll,TRUE
+dsclient.dll,TRUE
+drprov.dll,TRUE
+dpx.dll,TRUE
+dot3cfg.dll,TRUE
+dot3api.dll,TRUE
+dnsapi.dll,TRUE
+dmxmlhelputils.dll,TRUE
+dmpushproxy.dll,TRUE
+dmprocessxmlfiltered.dll,TRUE
+dmoleaututils.dll,TRUE
+dmiso8601utils.dll,TRUE
+dmenterprisediagnostics.dll,TRUE
+dmenrollengine.dll,TRUE
+dmcmnutils.dll,TRUE
+dmcfgutils.dll,TRUE
+dismcore.dll,TRUE
+dismapi.dll,TRUE
+directmanipulation.dll,TRUE
+dhcpcsvc6.dll,TRUE
+dhcpcsvc.dll,TRUE
+dhcpcmonitor.dll,TRUE
+devrtl.dll,TRUE
+devobj.dll,TRUE
+devicepairing.dll,TRUE
+devicecredential.dll,TRUE
+deviceassociation.dll,TRUE
+desktopshellext.dll,TRUE
+defragproxy.dll,TRUE
+dcomp.dll,TRUE
+dcntel.dll,TRUE
+dbghelp.dll,TRUE
+dbgcore.dll,TRUE
+davclnt.dll,TRUE
+dataexchange.dll,TRUE
+d3dcompiler_47.dll,TRUE
+d3d9.dll,TRUE
+d3d12.dll,TRUE
+d3d11.dll,TRUE
+d3d10warp.dll,TRUE
+d3d10core.dll,TRUE
+d3d10_1core.dll,TRUE
+d3d10_1.dll,TRUE
+d3d10.dll,TRUE
+d2d1.dll,TRUE
+cscui.dll,TRUE
+cscobj.dll,TRUE
+cscapi.dll,TRUE
+cryptxml.dll,TRUE
+cryptui.dll,TRUE
+cryptdll.dll,TRUE
+cryptbase.dll,TRUE
+credui.dll,TRUE
+coremessaging.dll,TRUE
+connect.dll,TRUE
+comdlg32.dll,TRUE
+colorui.dll,TRUE
+coloradapterclient.dll,TRUE
+cmpbk32.dll,TRUE
+clusapi.dll,TRUE
+clipc.dll,TRUE
+cldapi.dll,TRUE
+certenroll.dll,TRUE
+cabview.dll,TRUE
+cabinet.dll,TRUE
+bootmenuux.dll,TRUE
+bderepair.dll,TRUE
+bcrypt.dll,TRUE
+bcp47mrm.dll,TRUE
+bcp47langs.dll,TRUE
+bcd.dll,TRUE
+avrt.dll,TRUE
+authz.dll,TRUE
+authfwcfg.dll,TRUE
+auditpolcore.dll,TRUE
+audioses.dll,TRUE
+atl.dll,TRUE
+archiveint.dll,TRUE
+appxdeploymentclient.dll,TRUE
+appxalluserstore.dll,TRUE
+applicationframe.dll,TRUE
+apphelp.dll,TRUE
+aepic.dll,TRUE
+adsldpc.dll,TRUE
+activeds.dll,TRUE
\ No newline at end of file
diff --git a/lookups/hijacklibs.yml b/lookups/hijacklibs.yml
new file mode 100644
index 0000000000..8ca1473e26
--- /dev/null
+++ b/lookups/hijacklibs.yml
@@ -0,0 +1,7 @@
+description: A list of potentially abused libraries in Windows
+filename: hijacklibs.csv
+name: hijacklibs
+default_match: 'false'
+match_type: WILDCARD(attacker_tool_names)
+min_matches: 1
+case_sensitive_match: 'false'
\ No newline at end of file

From 17ba3c3e5183375dd40fb447f373273bf5ff7999 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 19 Aug 2022 15:21:15 -0600
Subject: [PATCH 03/14] fix

---
 lookups/hijacklibs.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lookups/hijacklibs.yml b/lookups/hijacklibs.yml
index 8ca1473e26..c1223d0343 100644
--- a/lookups/hijacklibs.yml
+++ b/lookups/hijacklibs.yml
@@ -2,6 +2,6 @@ description: A list of potentially abused libraries in Windows
 filename: hijacklibs.csv
 name: hijacklibs
 default_match: 'false'
-match_type: WILDCARD(attacker_tool_names)
+match_type: WILDCARD(library)
 min_matches: 1
 case_sensitive_match: 'false'
\ No newline at end of file

From ed2bc99c4652d0a2a846f8d39095436d4e51cef5 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 22 Aug 2022 10:14:10 -0600
Subject: [PATCH 04/14] sysmon fix

---
 ...ows_dll_search_order_hijacking_hunt_with_sysmon.yml | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
index e8806aeb63..313d885551 100644
--- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
+++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
@@ -10,13 +10,9 @@ description: The following hunting analytic is an experimental query built again
   This analytic will deprecate once this is fixed.
   This hunting analytic identifies known libraries in Windows that may be used in a DLL search order hijack or DLL Sideloading setting. This may require recompiling the DLL, moving the DLL or moving the vulnerable process. The query looks for any running out of system32 or syswow64. Some libraries natively run out of other application paths and will need to be added to the exclusion as needed.
   The lookup is comprised of Microsoft native libraries identified within the Hijacklibs.net project. 
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime values(Processes.process_name) as process_name from datamodel=Endpoint.Processes where Processes.dest!=unknown
-  Processes.user!=unknown NOT (Processes.process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*"))  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process_path   
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `drop_dm_object_name(Processes)` 
-  | lookup hijacklibs library AS process_name OUTPUT islibrary | search islibrary = True
-  | rename parent_process_name as "Process Name" process_name AS ImageLoaded process_path AS Module_Path
+search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*")) 
+  | lookup hijacklibs library AS process_name OUTPUT islibrary | search islibrary = True | rename Computer as dest process_name AS ImageLoaded process_path AS Module_Path
+  | stats values(parent_process_name) count by _time dest ImageLoaded Module_Path
   | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`'
 how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
 known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed.

From f0b053152e76b908014fd0838488afed9352e47b Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 22 Aug 2022 12:29:21 -0700
Subject: [PATCH 05/14] Update hijacklibs.csv

Forgot to include one of the dlls,
amsi.dll.  This caused the detection
testing to fail.
---
 lookups/hijacklibs.csv | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lookups/hijacklibs.csv b/lookups/hijacklibs.csv
index 058c68f5fc..609aced094 100644
--- a/lookups/hijacklibs.csv
+++ b/lookups/hijacklibs.csv
@@ -342,6 +342,7 @@ appxdeploymentclient.dll,TRUE
 appxalluserstore.dll,TRUE
 applicationframe.dll,TRUE
 apphelp.dll,TRUE
+amsi.dll,TRUE
 aepic.dll,TRUE
 adsldpc.dll,TRUE
-activeds.dll,TRUE
\ No newline at end of file
+activeds.dll,TRUE

From af639ac0666cb8aef5e7e870fd9cb7e8743c1562 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 22 Aug 2022 14:46:29 -0600
Subject: [PATCH 06/14] Update
 windows_dll_search_order_hijacking_hunt_with_sysmon.yml

---
 ...dll_search_order_hijacking_hunt_with_sysmon.yml | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
index 313d885551..e3499d4da1 100644
--- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
+++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
@@ -38,17 +38,13 @@ tags:
   impact: 10
   kill_chain_phases:
   - Exploitation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform DLL search order hijacking.
+  message: An instance of $parent_process_name$ loading $process_name$ was identified on endpoint $dest$.
   mitre_attack_id:
   - T1574.001
   - T1574
   nist:
   - DE.CM
   observable:
-  - name: user
-    type: User
-    role:
-    - Victim
   - name: dest
     type: Hostname
     role:
@@ -67,10 +63,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time 
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process_name
-  - Processes.process_name 
-  - Processes.process_path   
+  - dest 
+  - ImageLoaded
+  - Module_Path  
   risk_score: 1
   security_domain: endpoint

From 13d400611ae03a204b91e43ee36c0162bcdde18e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 22 Aug 2022 21:16:12 -0600
Subject: [PATCH 07/14] LSA :snake: SS

---
 ...ion_lsass_driver_registry_modification.yml | 62 +++++++++++++++++++
 ...sass_driver_registry_modification.test.yml | 13 ++++
 2 files changed, 75 insertions(+)
 create mode 100644 detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
 create mode 100644 tests/endpoint/windows_autostart_execution_lsass_driver_registry_modification.test.yml

diff --git a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
new file mode 100644
index 0000000000..129df31941
--- /dev/null
+++ b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
@@ -0,0 +1,62 @@
+name: Windows Autostart Execution LSASS Driver Registry Modification
+id: 57fb8656-141e-4d8a-9f51-62cff4ecb82a
+version: 1
+date: '2022-08-22'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the abuse of two undocumented registry keys that allow for a DLL to load into lsass.exe to potentially capture credentials. Upon successful modification of \CurrentControlSet\Services\NTDS\DirectoryServiceExtPt or \CurrentControlSet\Services\NTDS\LsaDbExtPt, a DLL either remote or local will be set as the value and load up into lsass.exe. Based on POC code a text file may be written to disk with credentials.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path IN ("*\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt","*\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt") 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest Registry.process_guid
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_autostart_execution_lsass_driver_registry_modification_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present on recent Windows Operating Systems. Filtering may be required based on process_name. In addition, look for non-standard, unsigned, module loads into LSASS. If query is too noisy, modify by adding Endpoint.processes process_name to query to identify the process making the modification.
+references:
+  - https://blog.xpnsec.com/exploring-mimikatz-part-1/
+  - https://github.com/oxfemale/LogonCredentialsSteal/tree/master/lsass_lib
+tags:
+  analytic_story:
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.008/atomic_red_team/windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: the registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$.
+  mitre_attack_id:
+  - T1547.008
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  risk_score: 49
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/windows_autostart_execution_lsass_driver_registry_modification.test.yml b/tests/endpoint/windows_autostart_execution_lsass_driver_registry_modification.test.yml
new file mode 100644
index 0000000000..e363ab61ff
--- /dev/null
+++ b/tests/endpoint/windows_autostart_execution_lsass_driver_registry_modification.test.yml
@@ -0,0 +1,13 @@
+name: Windows Autostart Execution LSASS Driver Registry Modification Unit Test
+tests:
+- name: Windows Autostart Execution LSASS Driver Registry Modification
+  file: endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.008/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 8248278109d092071d2f6869f851afd84247cdbf Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 22 Aug 2022 21:57:53 -0600
Subject: [PATCH 08/14] Remote Access Software

---
 .../windows_remote_access_software_hunt.yml   | 72 +++++++++++++++++++
 lookups/remote_access_software.csv            | 52 ++++++++++++++
 lookups/remote_access_software.yml            |  7 ++
 ...ndows_remote_access_software_hunt.test.yml | 13 ++++
 4 files changed, 144 insertions(+)
 create mode 100644 detections/endpoint/windows_remote_access_software_hunt.yml
 create mode 100644 lookups/remote_access_software.csv
 create mode 100644 lookups/remote_access_software.yml
 create mode 100644 tests/endpoint/windows_remote_access_software_hunt.test.yml

diff --git a/detections/endpoint/windows_remote_access_software_hunt.yml b/detections/endpoint/windows_remote_access_software_hunt.yml
new file mode 100644
index 0000000000..ca37c6ce24
--- /dev/null
+++ b/detections/endpoint/windows_remote_access_software_hunt.yml
@@ -0,0 +1,72 @@
+name: Windows Remote Access Software Hunt
+id: 8bd22c9f-05a2-4db1-b131-29271f28cb0a
+version: 1
+date: '2022-08-22'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic is meant to help organizations understand what remote access software is being used in the environment. When reviewing this hunt, confirm the software identified is authorized to be utilized. Based on fidelity, create a new analytic for specific utilities banned within the organization.
+  Adversaries use these utilities to retain remote access capabilities to the environment.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown Processes.user!=unknown by Processes.dest Processes.user Processes.process_name Processes.process 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `drop_dm_object_name(Processes)` 
+  | lookup remote_access_software remote_utility AS process_name OUTPUT isutility 
+  | search isutility = True 
+  | `windows_remote_access_software_hunt_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be found. Filter as needed and create higher fidelity analytics based off banned remote access software.
+references:
+  - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md
+tags:
+  analytic_story:
+  - Insider Threat
+  - Command and Control
+  - Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 10
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log
+  impact: 10
+  kill_chain_phases:
+  - Command & Control
+  message: The following Remote Access Software $process_name$ was identified on $dest$.
+  mitre_attack_id:
+  - T1219
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 1
+  security_domain: endpoint
\ No newline at end of file
diff --git a/lookups/remote_access_software.csv b/lookups/remote_access_software.csv
new file mode 100644
index 0000000000..8a643f7e47
--- /dev/null
+++ b/lookups/remote_access_software.csv
@@ -0,0 +1,52 @@
+remote_utility, description, isutility
+aweray_remote*.exe,AweRay (AweSun), TRUE
+aa_v*.exe, Ammyy Admin, TRUE
+AeroAdmin.exe, AeroAdmin, TRUE
+anydesk.exe, AnyDesk, TRUE
+AnyViewerSetup.exe, AnyViewer, TRUE
+RCClient.exe, AnyViewer, TRUE
+CService.exe, AnyViewer, TRUE
+atera_agent.exe, Atera, TRUE
+bomgar-scc.exe, BeyondTrust (Bomgar), TRUE
+bomgar-rdp.exe, BeyondTrust (Bomgar), TRUE
+screenconnect.clientservice.exe, ConnectWise Control, TRUE
+screenconnect.windowsclient.exe, ConnectWise Control, TRUE
+dwrcs.exe, Dameware, TRUE
+distant-desktop.exe, Distant Desktop, TRUE
+dwagsvc.exe, DW Service, TRUE
+g2comm.exe, GoToMyPC, TRUE
+g2fileh.exe, GoToMyPC, TRUE
+g2host.exe, GoToMyPC, TRUE
+g2mainh.exe, GoToMyPC, TRUE
+g2printh.exe, GoToMyPC, TRUE
+g2svc.exe, GoToMyPC, TRUE
+g2tray.exe, GoToMyPC, TRUE
+gopcsrv.exe, GoToMyPC, TRUE
+ROMServer.exe, LiteManager, TRUE 
+ROMFUSClient.exe, LiteManager, TRUE
+lmiignition.exe, LogMeIn, TRUE
+lmiguardiansvc.exe, LogMeIn, TRUE
+logmein*.exe, LogMeIn, TRUE
+awrem32.exe, PCAnywhere Client, TRUE
+awhost32.exe, PCAnywhere Server, TRUE
+PCMonitorManager.exe, Pulseway, TRUE
+pcmonitorsrv.exe, Pulseway, TRUE
+radmin3.exe, RAdmin, TRUE
+famitrfc.exe, RAdmin,  TRUE
+rutserv.exe, RemoteUtilities, TRUE
+smpcsetup.exe, ShowMyPC, TRUE
+showmypc*.exe, ShowMyPC, TRUE
+strwinclt.exe, Splashtop, TRUE
+supremo.exe, Supremo, TRUE
+supremohelper.exe, Supremo, TRUE
+supremosystem.exe, Supremo, TRUE
+teamviewer_desktop.exe, TeamViewer Desktop, TRUE
+teamviewer.exe, TeamViewer Service, TRUE
+teamviewer_service.exe, TeamViewer Service, TRUE
+winvnc.exe, VNC, TRUE
+vncviewer.exe, VNC, TRUE
+winvncsc.exe, VNC, TRUE
+winwvc.exe, VNC, TRUE
+Zaservice.exe, Zoho Assist, TRUE
+Zohours.exe, Zoho Assist, TRUE
+ZohoMeeting.exe, Zoho Assist, TRUE
\ No newline at end of file
diff --git a/lookups/remote_access_software.yml b/lookups/remote_access_software.yml
new file mode 100644
index 0000000000..f51fb4a138
--- /dev/null
+++ b/lookups/remote_access_software.yml
@@ -0,0 +1,7 @@
+description: A list of Remote Access Software
+filename: remote_access_software.csv
+name: remote_access_software
+default_match: 'false'
+match_type: WILDCARD(remote_software)
+min_matches: 1
+case_sensitive_match: 'false'
\ No newline at end of file
diff --git a/tests/endpoint/windows_remote_access_software_hunt.test.yml b/tests/endpoint/windows_remote_access_software_hunt.test.yml
new file mode 100644
index 0000000000..7487726e41
--- /dev/null
+++ b/tests/endpoint/windows_remote_access_software_hunt.test.yml
@@ -0,0 +1,13 @@
+name: Windows Remote Access Software Hunt Unit Test
+tests:
+- name: Windows Remote Access Software Hunt
+  file: endpoint/windows_remote_access_software_hunt.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 11eb0feac63284b417e5177ba4ad6ec618070820 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 25 Aug 2022 08:04:20 -0600
Subject: [PATCH 09/14] T1003.001 Update

---
 .../windows_possible_credential_dumping.yml   | 13 ++---
 lookups/hijacklibs.csv                        | 57 ++++++++++++++++++-
 2 files changed, 61 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml
index d88aa03de9..32f0f84bf9 100644
--- a/detections/endpoint/windows_possible_credential_dumping.yml
+++ b/detections/endpoint/windows_possible_credential_dumping.yml
@@ -1,7 +1,7 @@
 name: Windows Possible Credential Dumping
 id: e4723b92-7266-11ec-af45-acde48001122
-version: 2
-date: '2022-01-27'
+version: 3
+date: '2022-08-24'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -23,12 +23,8 @@ description: 'The following analytic is an enhanced version of two previous anal
   The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
   For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory,
   used to execute this module which is related to lsass dumping.'
-search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000",
-  "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438",
-  "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") | stats
-  count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess,
-  SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest |
-  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`'
+search: '`sysmon` EventCode=10 TargetImage=*\\lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*", "*kernelbase.dll*") NOT SourceUser IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE")| stats count min(_time) as firstTime max(_time) as lastTime by, Computer, SourceImage, GrantedAccess, TargetImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+  | `windows_possible_credential_dumping_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -42,6 +38,7 @@ references:
 - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
 - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
 - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN
+- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1003.001_DumpLSASS/DumpLSASS.ps1
 tags:
   analytic_story:
   - Credential Dumping
diff --git a/lookups/hijacklibs.csv b/lookups/hijacklibs.csv
index 609aced094..88b1d009dd 100644
--- a/lookups/hijacklibs.csv
+++ b/lookups/hijacklibs.csv
@@ -5,13 +5,16 @@ hha.dll,TRUE
 aclui.dll,TRUE
 xwtpw32.dll,TRUE
 xwizards.dll,TRUE
+xpsservices.dll,TRUE
 xolehlp.dll,TRUE
 xmllite.dll,TRUE
 wwapi.dll,TRUE
 wwancfg.dll,TRUE
 wtsapi32.dll,TRUE
+wsmsvc.dll,TRUE
 wshelper.dll,TRUE
 wshbth.dll,TRUE
+wscapi.dll,TRUE
 wpdshext.dll,TRUE
 wofutil.dll,TRUE
 wmsgapi.dll,TRUE
@@ -25,8 +28,10 @@ wlbsctrl.dll,TRUE
 wlancfg.dll,TRUE
 wlanapi.dll,TRUE
 wkscli.dll,TRUE
+winsync.dll,TRUE
 winsta.dll,TRUE
 winsqlite3.dll,TRUE
+winscard.dll,TRUE
 winrnr.dll,TRUE
 winnsi.dll,TRUE
 winmm.dll,TRUE
@@ -38,9 +43,11 @@ windowsudk.shellcommon.dll,TRUE
 windowsperformancerecordercontrol.dll,TRUE
 windowscodecsext.dll,TRUE
 windowscodecs.dll,TRUE
+windows.ui.immersive.dll,TRUE
 windows.storage.search.dll,TRUE
 windows.storage.dll,TRUE
 winbrand.dll,TRUE
+winbio.dll,TRUE
 wimgapi.dll,TRUE
 whhelper.dll,TRUE
 wevtapi.dll,TRUE
@@ -56,13 +63,18 @@ wbemprox.dll,TRUE
 vsstrace.dll,TRUE
 vssapi.dll,TRUE
 virtdisk.dll,TRUE
+version.dll,TRUE
+vdsutil.dll,TRUE
 vaultcli.dll,TRUE
 uxtheme.dll,TRUE
 uxinit.dll,TRUE
 utildll.dll,TRUE
 userenv.dll,TRUE
+urlmon.dll,TRUE
 upshared.dll,TRUE
 updatepolicy.dll,TRUE
+unattend.dll,TRUE
+umpdc.dll,TRUE
 uiribbon.dll,TRUE
 uireng.dll,TRUE
 uiautomationcore.dll,TRUE
@@ -73,6 +85,7 @@ twext.dll,TRUE
 ttdrecord.dll,TRUE
 tsworkspace.dll,TRUE
 tquery.dll,TRUE
+tpmcoreprovisioning.dll,TRUE
 timesync.dll,TRUE
 tdh.dll,TRUE
 tbs.dll,TRUE
@@ -87,14 +100,17 @@ ssp_isv.exe_rsaenh.dll,TRUE
 ssp.exe_rsaenh.dll,TRUE
 srvcli.dll,TRUE
 srpapi.dll,TRUE
+srmtrace.dll,TRUE
 srcore.dll,TRUE
 srclient.dll,TRUE
+sppcext.dll,TRUE
 sppc.dll,TRUE
 spp.dll,TRUE
 spectrumsyncclient.dll,TRUE
 snmpapi.dll,TRUE
 slc.dll,TRUE
 shell32.dll,TRUE
+security.dll,TRUE
 secur32.dll,TRUE
 schedcli.dll,TRUE
 scecli.dll,TRUE
@@ -116,16 +132,24 @@ reagent.dll,TRUE
 rasmontr.dll,TRUE
 rasman.dll,TRUE
 rasgcw.dll,TRUE
+rasdlg.dll,TRUE
 rasapi32.dll,TRUE
 radcui.dll,TRUE
 puiapi.dll,TRUE
 prvdmofcomp.dll,TRUE
+proximityservicepal.dll,TRUE
+proximitycommon.dll,TRUE
 propsys.dll,TRUE
+profapi.dll,TRUE
+prntvpt.dll,TRUE
 printui.dll,TRUE
+powrprof.dll,TRUE
 polstore.dll,TRUE
 policymanager.dll,TRUE
 pnrpnsp.dll,TRUE
+playsndsrv.dll,TRUE
 pla.dll,TRUE
+pkeyhelper.dll,TRUE
 peerdistsh.dll,TRUE
 pdh.dll,TRUE
 pcaui.dll,TRUE
@@ -135,6 +159,7 @@ p2p.dll,TRUE
 osuninst.dll,TRUE
 osksupport.dll,TRUE
 osbaseln.dll,TRUE
+opcservices.dll,TRUE
 onex.dll,TRUE
 omadmapi.dll,TRUE
 oleacc.dll,TRUE
@@ -157,10 +182,13 @@ netutils.dll,TRUE
 nettrace.dll,TRUE
 netshell.dll,TRUE
 netsetupapi.dll,TRUE
+netprovfw.dll,TRUE
 netprofm.dll,TRUE
 netplwiz.dll,TRUE
+netjoin.dll,TRUE
 netiohlp.dll,TRUE
 netid.dll,TRUE
+netapi32.dll,TRUE
 ndfapi.dll,TRUE
 ncrypt.dll,TRUE
 napinsp.dll,TRUE
@@ -168,8 +196,10 @@ mtxclu.dll,TRUE
 msxml3.dll,TRUE
 mswsock.dll,TRUE
 mswb7.dll,TRUE
+msvcp110_win.dll,TRUE
 msutb.dll,TRUE
 mstracer.dll,TRUE
+msiso.dll,TRUE
 msi.dll,TRUE
 msftedit.dll,TRUE
 msdtctm.dll,TRUE
@@ -193,13 +223,17 @@ midimap.dll,TRUE
 mi.dll,TRUE
 mfplat.dll,TRUE
 mfcore.dll,TRUE
+mfc42u.dll,TRUE
 mdmdiagnostics.dll,TRUE
+mbaexmlparser.dll,TRUE
 mapistub.dll,TRUE
 maintenanceui.dll,TRUE
 magnification.dll,TRUE
+lrwizdll.dll,TRUE
 lpksetupproxyserv.dll,TRUE
 logoncontroller.dll,TRUE
 logoncli.dll,TRUE
+lockhostingframework.dll,TRUE
 loadperf.dll,TRUE
 linkinfo.dll,TRUE
 licensingdiagspp.dll,TRUE
@@ -208,6 +242,7 @@ ktmw32.dll,TRUE
 ksuser.dll,TRUE
 kdstub.dll,TRUE
 joinutil.dll,TRUE
+iumsdk.dll,TRUE
 iumbase.dll,TRUE
 isv.exe_rsaenh.dll,TRUE
 iscsium.dll,TRUE
@@ -215,14 +250,17 @@ iscsidsc.dll,TRUE
 iri.dll,TRUE
 iphlpapi.dll,TRUE
 inproclogger.dll,TRUE
+ifsutil.dll,TRUE
 ifmon.dll,TRUE
 iertutil.dll,TRUE
 iedkcs32.dll,TRUE
 ieadvpack.dll,TRUE
 idstore.dll,TRUE
+icmp.dll,TRUE
 httpapi.dll,TRUE
 hnetmon.dll,TRUE
 hid.dll,TRUE
+gpapi.dll,TRUE
 getuname.dll,TRUE
 fxstiff.dll,TRUE
 fxsst.dll,TRUE
@@ -231,7 +269,10 @@ fwpuclnt.dll,TRUE
 fwpolicyiomgr.dll,TRUE
 fwcfg.dll,TRUE
 fwbase.dll,TRUE
+fvewiz.dll,TRUE
+fveskybackup.dll,TRUE
 fveapi.dll,TRUE
+framedynos.dll,TRUE
 fltlib.dll,TRUE
 flightsettings.dll,TRUE
 firewallapi.dll,TRUE
@@ -247,11 +288,13 @@ esent.dll,TRUE
 efsutil.dll,TRUE
 efsadu.dll,TRUE
 edputil.dll,TRUE
+edgeiso.dll,TRUE
 eappprxy.dll,TRUE
 eappcfg.dll,TRUE
 dynamoapi.dll,TRUE
 dxva2.dll,TRUE
 dxgi.dll,TRUE
+dxcore.dll,TRUE
 dwrite.dll,TRUE
 dwmcore.dll,TRUE
 dwmapi.dll,TRUE
@@ -260,8 +303,10 @@ duser.dll,TRUE
 dui70.dll,TRUE
 dsrole.dll,TRUE
 dsreg.dll,TRUE
+dsprop.dll,TRUE
 dsparse.dll,TRUE
 dsclient.dll,TRUE
+drvstore.dll,TRUE
 drprov.dll,TRUE
 dpx.dll,TRUE
 dot3cfg.dll,TRUE
@@ -274,6 +319,7 @@ dmoleaututils.dll,TRUE
 dmiso8601utils.dll,TRUE
 dmenterprisediagnostics.dll,TRUE
 dmenrollengine.dll,TRUE
+dmcommandlineutils.dll,TRUE
 dmcmnutils.dll,TRUE
 dmcfgutils.dll,TRUE
 dismcore.dll,TRUE
@@ -310,27 +356,35 @@ cscobj.dll,TRUE
 cscapi.dll,TRUE
 cryptxml.dll,TRUE
 cryptui.dll,TRUE
+cryptsp.dll,TRUE
 cryptdll.dll,TRUE
 cryptbase.dll,TRUE
 credui.dll,TRUE
+coreuicomponents.dll,TRUE
 coremessaging.dll,TRUE
+coredplus.dll,TRUE
 connect.dll,TRUE
+configmanager2.dll,TRUE
 comdlg32.dll,TRUE
 colorui.dll,TRUE
 coloradapterclient.dll,TRUE
+cmutil.dll,TRUE
 cmpbk32.dll,TRUE
 clusapi.dll,TRUE
 clipc.dll,TRUE
 cldapi.dll,TRUE
 certenroll.dll,TRUE
+certcli.dll,TRUE
 cabview.dll,TRUE
 cabinet.dll,TRUE
+bootux.dll,TRUE
 bootmenuux.dll,TRUE
 bderepair.dll,TRUE
 bcrypt.dll,TRUE
 bcp47mrm.dll,TRUE
 bcp47langs.dll,TRUE
 bcd.dll,TRUE
+batmeter.dll,TRUE
 avrt.dll,TRUE
 authz.dll,TRUE
 authfwcfg.dll,TRUE
@@ -340,9 +394,10 @@ atl.dll,TRUE
 archiveint.dll,TRUE
 appxdeploymentclient.dll,TRUE
 appxalluserstore.dll,TRUE
+appvpolicy.dll,TRUE
 applicationframe.dll,TRUE
 apphelp.dll,TRUE
-amsi.dll,TRUE
 aepic.dll,TRUE
 adsldpc.dll,TRUE
 activeds.dll,TRUE
+amsi.dll,TRUE
\ No newline at end of file

From c7aba6738ee3b6c8d853cd349faaafa4558e4d52 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 26 Aug 2022 06:01:15 -0600
Subject: [PATCH 10/14] Update windows_remote_access_software_hunt.yml

---
 detections/endpoint/windows_remote_access_software_hunt.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_remote_access_software_hunt.yml b/detections/endpoint/windows_remote_access_software_hunt.yml
index ca37c6ce24..c7bb7477bf 100644
--- a/detections/endpoint/windows_remote_access_software_hunt.yml
+++ b/detections/endpoint/windows_remote_access_software_hunt.yml
@@ -7,7 +7,7 @@ type: Hunting
 datamodel:
 - Endpoint
 description: The following hunting analytic is meant to help organizations understand what remote access software is being used in the environment. When reviewing this hunt, confirm the software identified is authorized to be utilized. Based on fidelity, create a new analytic for specific utilities banned within the organization.
-  Adversaries use these utilities to retain remote access capabilities to the environment.
+  Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown Processes.user!=unknown by Processes.dest Processes.user Processes.process_name Processes.process 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 

From c5606856506c04eb507a9f323efebed344f90327 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 26 Aug 2022 09:18:56 -0600
Subject: [PATCH 11/14] Update windows_possible_credential_dumping.yml

---
 detections/endpoint/windows_possible_credential_dumping.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml
index 32f0f84bf9..f3cd362cc9 100644
--- a/detections/endpoint/windows_possible_credential_dumping.yml
+++ b/detections/endpoint/windows_possible_credential_dumping.yml
@@ -23,7 +23,7 @@ description: 'The following analytic is an enhanced version of two previous anal
   The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
   For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory,
   used to execute this module which is related to lsass dumping.'
-search: '`sysmon` EventCode=10 TargetImage=*\\lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*", "*kernelbase.dll*") NOT SourceUser IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE")| stats count min(_time) as firstTime max(_time) as lastTime by, Computer, SourceImage, GrantedAccess, TargetImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+search: '`sysmon` EventCode=10 TargetImage=*\\lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*", "*kernelbase.dll*", "*kernel32.dll*") NOT SourceUser IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE")| stats count min(_time) as firstTime max(_time) as lastTime by, Computer, SourceImage, GrantedAccess, TargetImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | `windows_possible_credential_dumping_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your

From c912c7c93948d7a74f7713fe18dab27f4cc9f66e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 26 Aug 2022 10:58:17 -0600
Subject: [PATCH 12/14] Update
 linux_persistence_and_privilege_escalation_risk_behavior.yml

---
 ...nux_persistence_and_privilege_escalation_risk_behavior.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml
index 1b9d7cb2fb..7271b8b198 100644
--- a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml
+++ b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml
@@ -8,11 +8,11 @@ datamodel:
 - Risk
 description: The following correlation is specific to Linux persistence and privilege escalation tactics and is tied to two analytic stories and any Linux analytic tied to persistence and privilege escalation.
   These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where (All_Risk.analyticstories IN ("Linux Privilege Escalation", "Linux Persistence Techniques") OR source = "*Linux*") All_Risk.annotations.mitre_attack.mitre_tactic IN ("persistence", "privilege-escalation") All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source All_Risk.description
+search: '| tstats `security_content_summariesonly` count as risk_event_count, sum(All_Risk.calculated_risk_score) as risk_score, min(_time) as firstTime max(_time) as lastTime, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count from datamodel=Risk.All_Risk where (All_Risk.analyticstories IN ("Linux Privilege Escalation", "Linux Persistence Techniques") OR source = "*Linux*") All_Risk.annotations.mitre_attack.mitre_tactic IN ("persistence", "privilege-escalation") All_Risk.risk_object_type="system" by All_Risk.risk_object, All_Risk.risk_object_type, source 
   | `drop_dm_object_name(All_Risk)` 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
-  | stats values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics dc(source) as distinct_detection_name by risk_object 
+  | stats  values(source) as source, sum(risk_score) as risk_score, sum(risk_event_count) as risk_event_count, values(annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic min(firstTime) as firstTime max(lastTime) as lastTime, values(annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count dc(source) as source_count by risk_object, risk_object_type
   | where distinct_detection_name >= 4
   | `linux_persistence_and_privilege_escalation_risk_behavior_filter`'
 how_to_implement: Ensure Linux anomaly and TTP analytics are enabled. TTP may be set to Notables for point detections, anomaly should not be notables but risk generators. The correlation relies on more than x amount of distict detection names generated before generating a notable. Modify the value as needed. Default value is set to 4. This value may need to be increased based on activity in your environment.

From b2941ca7361c959302ae17e4f7af06318fad327c Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 26 Aug 2022 10:58:35 -0600
Subject: [PATCH 13/14] Update
 linux_persistence_and_privilege_escalation_risk_behavior.yml

---
 ...nux_persistence_and_privilege_escalation_risk_behavior.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml
index 7271b8b198..4dc24791a3 100644
--- a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml
+++ b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml
@@ -1,7 +1,7 @@
 name: Linux Persistence and Privilege Escalation Risk Behavior
 id: ad5ac21b-3b1e-492c-8e19-ea5d5e8e5cf1
-version: 1
-date: '2022-07-20'
+version: 2
+date: '2022-08-26'
 author: Michael Haag, Splunk
 type: Correlation
 datamodel:

From f9e770eaa5d11d86ea02720ceb45b627bf5f8eb1 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 26 Aug 2022 11:01:25 -0600
Subject: [PATCH 14/14] Update log4shell_cve_2021_44228_exploitation.yml

---
 .../log4shell_cve_2021_44228_exploitation.yml    | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
index 748ef0a9d9..84f274f63e 100644
--- a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
+++ b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
@@ -1,7 +1,7 @@
 name: Log4Shell CVE-2021-44228 Exploitation
 id: 9be30d80-3a39-4df9-9102-64a467b24eac
-version: 1
-date: '2022-01-26'
+version: 2
+date: '2022-08-26'
 author: Jose Hernandez, Splunk
 type: Correlation
 datamodel:
@@ -21,14 +21,10 @@ description: This correlation find exploitation of Log4Shell CVE-2021-44228 agai
   search finds exploitation. If we get a notable from this correlation search the
   best way to triage it is by investigating the affected systems against Log4Shell
   exploitation using Splunk SOAR playbooks.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Log4Shell
-  CVE-2021-44228" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic
-  source | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` |
-  `security_content_ctime(lastTime)` | stats values(risk_object) as affected_systems  values(source)
-  as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime)
-  as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic)
-  as distinct_tactics | where distinct_tactics >= 2 | `log4shell_cve_2021_44228_exploitation_filter`'
+search: '| tstats `security_content_summariesonly` count as risk_event_count, sum(All_Risk.calculated_risk_score) as risk_score, min(_time) as firstTime max(_time) as lastTime, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Log4Shell CVE-2021-44228" All_Risk.risk_object_type="system" by All_Risk.risk_object, All_Risk.risk_object_type, source 
+  | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` |
+  `security_content_ctime(lastTime)` | stats  values(source) as source, sum(risk_score) as risk_score, sum(risk_event_count) as risk_event_count, values(annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic min(firstTime) as firstTime max(lastTime) as lastTime, values(annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count dc(source) as source_count by risk_object, risk_object_type | where distinct_tactics >= 2 
+  | `log4shell_cve_2021_44228_exploitation_filter`'
 how_to_implement: To implement this correlation search a user needs to enable all
   detections in the Log4Shell Analytic Story and confirm it is generation risk events.
   A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain