Branch was auto-updated.

detections/cloud/aws_iam_accessdenied_discovery_events.yml

@@ -0,0 +1,47 @@
+name: AWS IAM AccessDenied Discovery Events
+id: 3e1f1568-9633-11eb-a69c-acde48001122
+version: 1
+date: '2021-04-05'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: The following detection identifies excessive AccessDenied events within
+  an hour timeframe. It is possible that an access key to AWS may have been stolen
+  and is being misused to perform discovery events. In these instances, the access
+  is not available with the key stolen therefore these events will be generated.
+search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com)
+  | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time)
+  as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn)
+  by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources
+  >= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `aws_iam_accessdenied_discovery_events_filter`'
+how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
+  this data. The search requires AWS Cloudtrail logs.
+known_false_positives: It is possible to start this detection will need to be tuned
+  by source IP or user. In addition, change the count values to an upper threshold
+  to restrict false positives.
+references:
+- https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
+tags:
+  analytic_story:
+  - Suspicious Cloud User Activities
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1580
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Splunk Security Analytics for AWS
+  required_fields:
+  - _time
+  - eventName
+  - eventSource
+  - userAgent
+  - errorCode
+  - userIdentity.type
+  security_domain: access
+  automated_detection_testing: passed

detections/cloud/aws_iam_assume_role_policy_brute_force.yml

@@ -0,0 +1,49 @@
+name: AWS IAM Assume Role Policy Brute Force
+id: f19e09b0-9308-11eb-b7ec-acde48001122
+version: 1
+date: '2021-04-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: The following detection identifies any malformed policy document exceptions
+  with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`.  Meaning, when an adversary is attempting to identify
+  a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing.
+search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure
+  (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as
+  lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource
+  aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion
+  userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`'
+how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
+  this data. The search requires AWS Cloudtrail logs. Set the `where count` greater
+  than a value to identify suspicious activity in your environment.
+known_false_positives: This detection will require tuning to provide high fidelity
+  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
+  or by groups of users.
+references:
+- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities
+- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
+- https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html
+tags:
+  analytic_story:
+  - AWS IAM Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1580
+  - T1110
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Splunk Security Analytics for AWS
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - requestParameters.policyName
+  security_domain: access
+  automated_detection_testing: passed

detections/cloud/aws_iam_delete_policy.yml

@@ -0,0 +1,49 @@
+name: AWS IAM Delete Policy
+id: ec3a9362-92fe-11eb-99d0-acde48001122
+version: 1
+date: '2021-04-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: The following detection identifes when a policy is deleted on AWS. This
+  does not identify whether successful or failed, but the error messages tell a story
+  of suspicious attempts. There is a specific process to follow when deleting a policy.
+  First, detach the policy from all users, groups, and roles that the policy is attached
+  to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
+search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats
+  count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
+  as policyArn by src eventName eventSource aws_account_id errorCode errorMessage
+  userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`'
+how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
+  this data. The search requires AWS Cloudtrail logs.
+known_false_positives: This detection will require tuning to provide high fidelity
+  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
+  or by groups of users. Not every user with AWS access should have permission to
+  delete policies (least privilege). In addition, this may be saved seperately and
+  tuned for failed or success attempts only.
+references:
+- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html
+- https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html
+tags:
+  analytic_story:
+  - AWS IAM Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1098
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Splunk Security Analytics for AWS
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - requestParameters.policyArn
+  security_domain: access
+  automated_detection_testing: passed

detections/cloud/aws_iam_failure_group_deletion.yml

@@ -0,0 +1,49 @@
+name: AWS IAM Failure Group Deletion
+id: 723b861a-92eb-11eb-93b8-acde48001122
+version: 1
+date: '2021-04-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: This detection identifies failure attempts to delete groups. We want to identify
+  when a group is attempting to be deleted, but either access is denied, there is
+  a conflict or there is no group. This is indicative of administrators performing
+  an action, but also could be suspicious behavior occurring. Review parallel IAM
+  events - recently added users, new groups and so forth.
+search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode
+  IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com)
+  | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName)
+  as group_name by src eventName eventSource aws_account_id errorCode errorMessage
+  userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `aws_iam_failure_group_deletion_filter`'
+how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
+  this data. The search requires AWS Cloudtrail logs.
+known_false_positives: This detection will require tuning to provide high fidelity
+  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
+  or by groups of users. Not every user with AWS access should have permission to
+  delete groups (least privilege).
+references:
+- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
+- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
+tags:
+  analytic_story:
+  - AWS IAM Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1098
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Splunk Security Analytics for AWS
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - requestParameters.groupName
+  security_domain: identity
+  automated_detection_testing: passed

detections/cloud/aws_iam_successful_group_deletion.yml

@@ -0,0 +1,48 @@
+name: AWS IAM Successful Group Deletion
+id: e776d06c-9267-11eb-819b-acde48001122
+version: 1
+date: '2021-03-31'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: The following query uses IAM events to track the success of a group being
+  deleted on AWS. This is typically not indicative of malicious behavior, but a precurser
+  to additional events thay may unfold. Review parallel IAM events - recently added
+  users, new groups and so forth. Inversely, review failed attempts in a similar manner.
+search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success
+  (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as
+  lastTime values(requestParameters.groupName) by src eventName eventSource errorCode
+  user_agent awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `aws_iam_successful_group_deletion_filter`'
+how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
+  this data. The search requires AWS Cloudtrail logs.
+known_false_positives: This detection will require tuning to provide high fidelity
+  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
+  or by groups of users. Not every user with AWS access should have permission to
+  delete groups (least privilege).
+references:
+- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
+- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
+tags:
+  analytic_story:
+  - AWS IAM Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1069.003
+  - T1098
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Splunk Security Analytics for AWS
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - requestParameters.groupName
+  security_domain: identity
+  automated_detection_testing: passed

detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml

@@ -0,0 +1,54 @@
+name: DLLHost with no Command Line Arguments with Network
+id: f1c07594-a141-11eb-8407-acde48001122
+version: 1
+date: '2021-04-19'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies DLLHost.exe with no command line arguments
+  with a network connection. It is unusual for DLLHost.exe to execute with no command
+  line arguments present. This particular behavior is common with malicious software,
+  including Cobalt Strike. During investigation, triage any network connections and
+  parallel processes. Identify any suspicious module loads related to credential dumping
+  or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=dllhost.exe by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(dllhost\.exe.{0,4}$)" | join  process_id [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id
+  Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename  dest as connection_to_CNC]
+  | table _time dest parent_process_name process_name process_path process process_id
+  connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
+known_false_positives: Although unlikely, some legitimate third party applications
+  may use a moved copy of dllhost, triggering a false positive.
+references:
+- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
+- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
+tags:
+  analytic_story:
+  - Cobalt Strike
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest_port
+  - process_path
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/excel_spawning_powershell.yml

@@ -0,0 +1,52 @@
+name: Excel Spawning PowerShell
+id: 42d40a22-9be3-11eb-8f08-acde48001122
+version: 1
+date: '2021-04-12'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies Microsoft Excel spawning PowerShell.
+  Typically, this is not common behavior and not default with Excel.exe. Excel.exe
+  will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16`
+  (version will vary). PowerShell spawning from Excel.exe is common for a spearphishing
+  attachment and is actively used. Albeit, the command executed will most likely be
+  encoded and captured via another detection. During triage, review parallel processes
+  and identify any files that may have been written.
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.parent_process_name="excel.exe" Processes.process_name IN ("powershell.exe",
+  "pwsh.exe")  by Processes.parent_process Processes.process_name Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+  | `excel_spawning_powershell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives should be limited, but if any are present,
+  filter as needed.
+references:
+- https://redcanary.com/threat-detection-report/techniques/powershell/
+- https://attack.mitre.org/techniques/T1566/001/
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest
+  - user
+  - parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/excel_spawning_windows_script_host.yml

@@ -0,0 +1,56 @@
+name: Excel Spawning Windows Script Host
+id: 57fe880a-9be3-11eb-9bf3-acde48001122
+version: 1
+date: '2021-04-12'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies Microsoft Excel spawning Windows Script
+  Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and
+  not default with Excel.exe. Excel.exe will generally be found in the following path
+  `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe`
+  or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`.
+  `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing
+  attachment and is actively used. Albeit, the command-line executed will most likely
+  be obfuscated and captured via another detection. During triage, review parallel
+  processes and identify any files that may have been written. Review the reputation
+  of the remote destination and block accordingly.
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.parent_process_name="excel.exe" Processes.process_name IN ("cscript.exe",
+  "wscript.exe")  by Processes.parent_process Processes.process_name Processes.user
+  Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+  | `excel_spawning_windows_script_host_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives should be limited, but if any are present,
+  filter as needed. In some instances, `cscript.exe` is used for legitimate business
+  practices.
+references:
+- https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/
+- https://attack.mitre.org/techniques/T1566/001/
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest
+  - user
+  - parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml

@@ -0,0 +1,55 @@
+name: GPUpdate with no Command Line Arguments with Network
+id: 2c853856-a140-11eb-a5b5-acde48001122
+version: 1
+date: '2021-04-19'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies gpupdate.exe with no command line arguments
+  and with a network connection. It is unusual for gpupdate.exe to execute with no
+  command line arguments present. This particular behavior is common with malicious
+  software, including Cobalt Strike. During investigation, triage any network connections
+  and parallel processes. Identify any suspicious module loads related to credential
+  dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=gpupdate.exe by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(gpupdate\.exe.{0,4}$)" | join  process_id [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id
+  Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename  dest as connection_to_CNC]
+  | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC
+  dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Limited false positives may be present in small environments.
+  Tuning may be required based on parent process.
+references:
+- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
+- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
+tags:
+  analytic_story:
+  - Cobalt Strike
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest_port
+  - process_path
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/office_application_spawn_rundll32_process.yml

@@ -28,7 +28,7 @@ references:
 - https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe
 tags:
   analytic_story:
-  - Phishing Payloads
+  - Spearphishing Attachments
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:

detections/endpoint/office_document_creating_schedule_task.yml

@@ -34,7 +34,7 @@ references:
 - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
 tags:
   analytic_story:
-  - Phishing Payloads
+  - Spearphishing Attachments
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:

detections/endpoint/office_document_executing_macro_code.yml

@@ -27,7 +27,7 @@ references:
 - https://www.joesandbox.com/analysis/386500/0/html
 tags:
   analytic_story:
-  - Phishing Payloads
+  - Spearphishing Attachments
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:

detections/endpoint/office_document_spawned_child_process_to_download.yml

@@ -26,7 +26,7 @@ references:
 - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#
 tags:
   analytic_story:
-  - Phishing Payloads
+  - Spearphishing Attachments
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:

detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml

@@ -0,0 +1,57 @@
+name: Office Product Spawning Rundll32 with no DLL
+id: c661f6be-a38c-11eb-be57-acde48001122
+version: 1
+date: '2021-04-22'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies the latest behavior utilized by IcedID
+  malware family. This detection identifies any Windows Office Product spawning `rundll32.exe`
+  without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe`
+  will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. In addition, Threat
+  Research has released a detection identifying the use of `DllRegisterServer` on
+  the command-line of `rundll32.exe`. In this instance, we narrow our detection down
+  to the Office suite as a parent process. During triage, review all file modifications.
+  Capture and analyze the `DLL` that was dropped to disk. The Office Product will
+  have reached out to a remote destination, capture and block the IPs or domain. Review
+  additional parallel processes for further activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=rundll32.exe
+  (Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `office_product_spawning_rundll32_with_no_dll_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives should be limited, but if any are present,
+  filter as needed.
+references:
+- https://www.joesandbox.com/analysis/395471/0/html
+- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/
+- https://any.run/malware-trends/icedid
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest
+  - user
+  - parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml

@@ -30,7 +30,7 @@ references:
 - https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html
 tags:
   analytic_story:
-  - Phishing Payloads
+  - Spearphishing Attachments
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml

@@ -0,0 +1,58 @@
+name: Rundll32 with no Command Line Arguments with Network
+id: 35307032-a12d-11eb-835f-acde48001122
+version: 1
+date: '2021-04-19'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies rundll32.exe with no command line arguments
+  and performing a network connection. It is unusual for rundll32.exe to execute with
+  no command line arguments present. This particular behavior is common with malicious
+  software, including Cobalt Strike. During investigation, triage any network connections
+  and parallel processes. Identify any suspicious module loads related to credential
+  dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=rundll32.exe by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(rundll32\.exe.{0,4}$)" | join  process_id [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id
+  Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename  dest as connection_to_CNC]
+  | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC
+  dest_port | `rundll32_with_no_command_line_arguments_with_network_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of rundll32, triggering a false positive.
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+tags:
+  analytic_story:
+  - Suspicious Rundll32 Activity
+  - Cobalt Strike
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest_port
+  - process_path
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml

@@ -0,0 +1,53 @@
+name: SearchProtocolHost with no Command Line with Network
+id: b690df8c-a145-11eb-a38b-acde48001122
+version: 1
+date: '2021-04-19'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies searchprotocolhost.exe with no command
+  line arguments and with a network connection. It is unusual for searchprotocolhost.exe
+  to execute with no command line arguments present. This particular behavior is common
+  with malicious software, including Cobalt Strike. During investigation, identify
+  any network connections and parallel processes. Identify any suspicious module loads
+  related to credential dumping or file writes. searchprotocolhost.exe is natively
+  found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(searchprotocolhost\.exe.{0,4}$)" | join  process_id [| tstats
+  `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port
+  !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
+  | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
+  process_path process process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.
+known_false_positives: Limited false positives may be present in small environments.
+  Tuning may be required based on parent process.
+references:
+- https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc
+tags:
+  analytic_story:
+  - Cobalt Strike
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest_port
+  - process_path
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml

@@ -0,0 +1,66 @@
+name: WinEvent Scheduled Task Created to Spawn Shell
+id: 203ef0ea-9bd8-11eb-8201-acde48001122
+version: 1
+date: '2021-04-12'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled
+  task was created`, to identify suspicious tasks registered on Windows either via
+  schtasks.exe OR TaskService with a command to be executed with a native Windows
+  shell (PowerShell, Cmd, Wscript, Cscript).\
+
+  The search will return the first time and last time the task was registered, as
+  well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
+  it is `Hidden` or not.\
+
+  schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\
+
+  The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`.
+  If found loaded by another process, it is possible a scheduled task is being registered
+  within that process context in memory.\
+
+  Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService?
+  Review the job created and the Command to be executed. Capture any artifacts on
+  disk and review. Identify any parallel processes within the same timeframe to identify
+  source.'
+search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
+  ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*",
+  "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author,
+  Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `winevent_scheduled_task_created_to_spawn_shell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
+  required.
+known_false_positives: False positives are possible if legitimate applications are
+  allowed to register tasks that call a shell to be spawned. Filter as needed based
+  on command-line or processes that are used legitimately.
+references:
+- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
+- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698
+- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
+- https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Ransomware
+  - Ryuk Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - Task_Name
+  - Description
+  - Command
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -0,0 +1,66 @@
+name: WinEvent Scheduled Task Created Within Public Path
+id: 5d9c6eee-988c-11eb-8253-acde48001122
+version: 1
+date: '2021-04-08'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled
+  task was created`, to identify suspicious tasks registered on Windows either via
+  schtasks.exe OR TaskService with a command to be executed from a user writeable
+  file path.\
+
+  The search will return the first time and last time the task was registered, as
+  well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
+  it is `Hidden` or not.\
+
+  schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\
+
+  The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`.
+  If found loaded by another process, it is possible a scheduled task is being registered
+  within that process context in memory.\
+
+  Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via
+  TaskService. Review the job created and the Command to be executed. Capture any
+  artifacts on disk and review. Identify any parallel processes within the same timeframe
+  to identify source.'
+search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
+  ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*",
+  "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by
+  dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
+  required.
+known_false_positives: False positives are possible if legitimate applications are
+  allowed to register tasks in public paths. Filter as needed based on paths that
+  are used legitimately.
+references:
+- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
+- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698
+- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
+- https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN
+- https://app.any.run/tasks/e26f1b2e-befa-483b-91d2-e18636e2faf3/
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Ransomware
+  - Ryuk Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - Task_Name
+  - Description
+  - Command
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/winword_spawning_cmd.yml

@@ -0,0 +1,52 @@
+name: Winword Spawning Cmd
+id: 6fcbaedc-a37b-11eb-956b-acde48001122
+version: 1
+date: '2021-04-22'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies Microsoft Word spawning `cmd.exe`.
+  Typically, this is not common behavior and not default with winword.exe. Winword.exe
+  will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16`
+  (version will vary). Cmd.exe spawning from winword.exe is common for a spearphishing
+  attachment and is actively used. Albeit, the command-line will indicate what is
+  being executed. During triage, review parallel processes and identify any files
+  that may have been written. It is possible that COM is utilized to trampoline the
+  child process to `explorer.exe` or `wmiprvse.exe`.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winword.exe
+  Processes.process_name=cmd.exe by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `winword_spawning_cmd_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives should be limited, but if any are present,
+  filter as needed.
+references:
+- https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest
+  - user
+  - parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/winword_spawning_powershell.yml

@@ -0,0 +1,54 @@
+name: Winword Spawning PowerShell
+id: b2c950b8-9be2-11eb-8658-acde48001122
+version: 1
+date: '2021-04-12'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies Microsoft Word spawning PowerShell.
+  Typically, this is not common behavior and not default with winword.exe. Winword.exe
+  will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16`
+  (version will vary). PowerShell spawning from winword.exe is common for a spearphishing
+  attachment and is actively used. Albeit, the command executed will most likely be
+  encoded and captured via another detection. During triage, review parallel processes
+  and identify any files that may have been written.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe"
+  Processes.process_name IN ("powershell.exe", "pwsh.exe") by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `winword_spawning_powershell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives should be limited, but if any are present,
+  filter as needed.
+references:
+- https://redcanary.com/threat-detection-report/techniques/powershell/
+- https://attack.mitre.org/techniques/T1566/001/
+- https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/
+- https://app.any.run/tasks/181ac90b-0898-4631-8701-b778a30610ad/
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest
+  - user
+  - parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/winword_spawning_windows_script_host.yml

@@ -0,0 +1,54 @@
+name: Winword Spawning Windows Script Host
+id: 637e1b5c-9be1-11eb-9c32-acde48001122
+version: 1
+date: '2021-04-12'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies Microsoft Winword.exe spawning Windows
+  Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior
+  and not default with Winword.exe. Winword.exe will generally be found in the following
+  path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe`
+  or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64\`.
+  `cscript.exe` or `wscript.exe` spawning from Winword.exe is common for a spearphishing
+  attachment and is actively used. Albeit, the command-line executed will most likely
+  be obfuscated and captured via another detection. During triage, review parallel
+  processes and identify any files that may have been written. Review the reputation
+  of the remote destination and block accordingly.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe"
+  Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `winword_spawning_windows_script_host_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: There will be limited false positives and it will be different
+  for every environment. Tune by child process or command-line as needed.
+references:
+- https://attack.mitre.org/techniques/T1566/001/
+tags:
+  analytic_story:
+  - Spearphishing Attachment
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest
+  - user
+  - parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml

@@ -1,4 +1,4 @@
-name: Detect Oulook exe writing a  zip file
+name: Detect Outlook exe writing a zip file
 id: a51bfe1a-94f0-4822-b1e4-16ae10145893
 version: 3
 date: '2020-07-21'
@@ -22,7 +22,7 @@ search: '| tstats `security_content_summariesonly`  min(_time) as firstTime max(
   | rename process_id as malicious_id| fields malicious_id outlook_id dest file_path
   file_name file_hash count file_id] | table firstTime lastTime user malicious_id
   outlook_id process_name parent_process_name file_name  file_path | where file_name
-  != "" | `detect_oulook_exe_writing_a__zip_file_filter` '
+  != "" | `detect_outlook_exe_writing_a_zip_file_filter` '
 how_to_implement: You must be ingesting data that records filesystem and process activity
   from your hosts to populate the Endpoint data model. This is typically populated
   via endpoint detection-and-response product, such as Carbon Black, or endpoint data
@@ -32,7 +32,7 @@ known_false_positives: It is not uncommon for outlook to write legitimate zip fi
 references: []
 tags:
   analytic_story:
-  - Phishing Payloads
+  - Spearphishing Attachments
   asset_type: Endpoint
   cis20:
   - CIS 7

stories/spearphishing_attachments.yml

@@ -1,4 +1,4 @@
-name: Phishing Payloads
+name: Spearphishing Attachments
 id: 57226b40-94f3-4ce5-b101-a75f67759c27
 version: 1
 date: '2019-04-29'
@@ -46,7 +46,7 @@ narrative: 'Despite its simplicity, phishing remains the most pervasive and dang
 references:
 - https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html
 tags:
-  analytic_story: Phishing Payloads
+  analytic_story: Spearphishing Attachments
   category:
   - Adversary Tactics
   product:

tests/cloud/aws_iam_accessdenied_discovery_events.test.yml

@@ -0,0 +1,13 @@
+name: AWS IAM AccessDenied Discovery Events Unit Test
+tests:
+- name: AWS IAM AccessDenied Discovery Events
+  file: cloud/aws_iam_accessdenied_discovery_events.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_iam_accessdenied_discovery_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True

tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml

@@ -0,0 +1,13 @@
+name: AWS IAM Assume Role Policy Brute Force Unit Test
+tests:
+- name: AWS IAM Assume Role Policy Brute Force
+  file: cloud/aws_iam_assume_role_policy_brute_force.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_iam_assume_role_policy_brute_force.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True

tests/cloud/aws_iam_delete_policy.test.yml

@@ -0,0 +1,13 @@
+name: AWS IAM Delete Policy Unit Test
+tests:
+- name: AWS IAM Delete Policy
+  file: cloud/aws_iam_delete_policy.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_iam_delete_policy.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True

tests/cloud/aws_iam_failure_group_deletion.test.yml

@@ -0,0 +1,13 @@
+name: AWS IAM Failure Group Deletion Unit Test
+tests:
+- name: AWS IAM Failure Group Deletion
+  file: cloud/aws_iam_failure_group_deletion.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_iam_delete_policy.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True

tests/cloud/aws_iam_successful_group_deletion.test.yml

@@ -0,0 +1,13 @@
+name: AWS IAM Successful Group Deletion Unit Test
+tests:
+- name: AWS IAM Successful Group Deletion
+  file: cloud/aws_iam_successful_group_deletion.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_iam_successful_group_deletion.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True

tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml

@@ -0,0 +1,12 @@
+name: DLLHost with no Command Line Arguments with Network Unit Test
+tests:
+- name: DLLHost with no Command Line Arguments with Network
+  file: endpoint/dllhost_with_no_command_line_arguments_with_network.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/excel_spawning_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Excel Spawning PowerShell Unit Test
+tests:
+- name: Excel Spawning PowerShell
+  file: endpoint/excel_spawning_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/excel_spawning_windows_script_host.test.yml

@@ -0,0 +1,12 @@
+name: Excel Spawning Windows Script Host Unit Test
+tests:
+- name: Excel Spawning Windows Script Host
+  file: endpoint/excel_spawning_windows_script_host.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/gpupdate_with_no_command_line_arguments_with_network.test.yml

@@ -0,0 +1,12 @@
+name: GPUpdate with no Command Line Arguments with Network Unit Test
+tests:
+- name: GPUpdate with no Command Line Arguments with Network
+  file: endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/office_product_spawning_rundll32_with_no_dll.test.yml

@@ -0,0 +1,12 @@
+name: Office Product Spawning Rundll32 with no DLL Unit Test
+tests:
+- name: Office Product Spawning Rundll32 with no DLL
+  file: endpoint/office_product_spawning_rundll32_with_no_dll.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_icedid.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml

@@ -0,0 +1,12 @@
+name: Rundll32 with no Command Line Arguments with Network Unit Test
+tests:
+- name: Rundll32 with no Command Line Arguments with Network
+  file: endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml

@@ -0,0 +1,12 @@
+name: SearchProtocolHost with no Command Line with Network Unit Test
+tests:
+- name: SearchProtocolHost with no Command Line with Network
+  file: endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml

@@ -0,0 +1,13 @@
+name: WinEvent Scheduled Task Created to Spawn Shell Unit Test
+tests:
+- name: WinEvent Scheduled Task Created to Spawn Shell
+  file: endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True

tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml

@@ -0,0 +1,13 @@
+name: WinEvent Scheduled Task Created Within Public Path Unit Test
+tests:
+- name: WinEvent Scheduled Task Created Within Public Path
+  file: endpoint/winevent_scheduled_task_created_within_public_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True

tests/endpoint/winword_spawning_cmd.test.yml

@@ -0,0 +1,12 @@
+name: Winword Spawning Cmd Unit Test
+tests:
+- name: Winword Spawning Cmd
+  file: endpoint/winword_spawning_cmd.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/winword_spawning_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Winword Spawning PowerShell Unit Test
+tests:
+- name: Winword Spawning PowerShell
+  file: endpoint/winword_spawning_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/winword_spawning_windows_script_host.test.yml

@@ -0,0 +1,12 @@
+name: Winword Spawning Windows Script Host Unit Test
+tests:
+- name: Winword Spawning Windows Script Host
+  file: endpoint/winword_spawning_windows_script_host.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog