removing unused eventstats calculating global_avg

detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -19,7 +19,6 @@ description: 'The following analytic identifies one source endpoint failing to a
 search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 
  | bucket span=2m _time
  | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address
- | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std 
  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address
  | eval upperBound=(comp_avg+comp_std*3)
  | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -16,7 +16,7 @@ description: 'The following analytic identifies one source endpoint failing to a
   This detection will trigger on the domain controller against which the offending host performs the password spraying attack.\
 
   The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.'
-search: '`wineventlog_security` ventCode=4768 Result_Code=0x6 Account_Name!="*$"  
+search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$"  
  | bucket span=2m _time
  | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address
  | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std 

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml

@@ -19,7 +19,6 @@ description: 'The following analytic identifies one source endpoint failing to a
 search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure 
  | bucket span=2m _time
  | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation
- | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std 
  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation
  | eval upperBound=(comp_avg+comp_std*3)
  | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)

detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml

@@ -21,7 +21,6 @@ search: ' `wineventlog_security` EventCode=4648
  | eval Destination_Account = mvindex(Account_Name, 1) 
  | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$"
  | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account
- | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std 
  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName
  | eval upperBound=(comp_avg+comp_std*3)
  | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)

detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -19,7 +19,6 @@ description: 'The following analytic identifies one source endpoint failing to a
 search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$"
  | bucket span=2m _time
  | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address
- | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std 
  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address
  | eval upperBound=(comp_avg+comp_std*3)
  | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)

detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml

@@ -19,7 +19,6 @@ description: 'The following analytic identifies one source endpoint failing to a
 search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure 
  | bucket span=2m _time
  | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation
- | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std 
  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation
  | eval upperBound=(comp_avg+comp_std*3)
  | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)

detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml

@@ -21,7 +21,6 @@ search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name
  | eval Source_Account = mvindex(Account_Name, 0) 
  | eval Destination_Account = mvindex(Account_Name, 1)
  | stats dc(Destination_Account) AS unique_accounts values(Account_Name) as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName
- | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std 
  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Caller_Process_Name, Source_Account, ComputerName
  | eval upperBound=(comp_avg+comp_std*3)
  | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)

detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml

@@ -21,7 +21,6 @@ search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Addr
  | eval Destination_Account = mvindex(Account_Name, 1) 
  | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts by _time, Source_Network_Address, ComputerName
  | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std
- | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName
  | eval upperBound=(comp_avg+comp_std*3)
  | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
  | search isOutlier=1