From b138ecff4e3235457ed700cedb1eeb8309dd5109 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-229-251>
Date: Fri, 10 Sep 2021 18:18:08 +0000
Subject: [PATCH] Added detection testing service results inOffice Product
 Writing cab or inf

---
 .../office_product_writing_cab_or_inf.yml     | 46 ++++++++++---------
 1 file changed, 25 insertions(+), 21 deletions(-)

diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml
index 766e1b8f50..d05c4928b5 100644
--- a/detections/endpoint/office_product_writing_cab_or_inf.yml
+++ b/detections/endpoint/office_product_writing_cab_or_inf.yml
@@ -6,18 +6,20 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies behavior related to CVE-2021-40444. Whereas the
-  malicious document will load ActiveX and download the remote payload (.inf, .cab). 
-  During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further.
+description: The following analytic identifies behavior related to CVE-2021-40444.
+  Whereas the malicious document will load ActiveX and download the remote payload
+  (.inf, .cab). During triage, review parallel processes and further activity on endpoint
+  to identify additional patterns. Retrieve the file modifications and analyze further.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process
-  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
-  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.inf","*.cab")
-  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
-  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
-  file_name file_path process_name process_path process] | dedup file_create_time
-  | table dest, process_name, process, file_create_time, file_name, file_path | `office_product_writing_cab_or_inf_filter`'
+  where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
+  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
+  where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest
+  Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)`
+  | fields _time dest file_create_time file_name file_path process_name process_path
+  process] | dedup file_create_time | table dest, process_name, process, file_create_time,
+  file_name, file_path | `office_product_writing_cab_or_inf_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
@@ -26,15 +28,16 @@ known_false_positives: The query is structured in a way that `action` (read, cre
   is not defined. Review the results of this query, filter, and tune as necessary.
   It may be necessary to generate this query specific to your endpoint product.
 references:
-  - https://twitter.com/vxunderground/status/1436326057179860992?s=20
-  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-  - https://twitter.com/RonnyTNL/status/1436334640617373699?s=20
+- https://twitter.com/vxunderground/status/1436326057179860992?s=20
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://twitter.com/RonnyTNL/status/1436334640617373699?s=20
 tags:
-  analytic_story:  
+  analytic_story:
   - Spearphishing Attachments
   - Microsoft MSHTML Remote Code Execution CVE-2021-40444
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -50,16 +53,16 @@ tags:
   - process
   - file_create_time
   - file_name
-  - file_path 
+  - file_path
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$.
+  message: An instance of $process_name$ was identified on $dest$ writing an inf or
+    cab file to this. This is not typical of $process_name$.
   observable:
   - name: dest
     type: Hostname
@@ -68,4 +71,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  automated_detection_testing: passed