Branch was auto-updated.

detections/endpoint/7zip_commandline_to_smb_share_path.yml

@@ -41,13 +41,13 @@ tags:
   - T1560
   observable:
   - name: dest
-    type: Hostname
+    type: Endpoint
     role:
     - Victim
-  - name: SourceImage
-    type: Process
+  - name: user
+    type: User
     role:
-    - Attacker
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/active_setup_registry_autostart.yml

@@ -14,7 +14,7 @@ description: This analytic is to detect a suspicious modification of the active
   valid setup installer that creating or modifying this registry.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user
   | `drop_dm_object_name(Registry)`
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`'
@@ -35,7 +35,7 @@ tags:
   asset_type: Endpoint
   confidence: 80
   impact: 80
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  message: modified/added/deleted registry entry $registry_path$ in $dest$
   mitre_attack_id:
   - T1547.014
   - T1547

detections/endpoint/add_defaultuser_and_password_in_registry.yml

@@ -13,7 +13,7 @@ description: this search is to detect a suspicious registry modification to impl
   premise.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest Registry.registry_value_data Registry.process_guid 
   | `drop_dm_object_name(Registry)`
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -11,7 +11,7 @@ description: This analytic detects a potential suspicious modification of firewa
   by allowing the traffic in a firewall rule.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*"  Registry.registry_value_data = "*|LPort=*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*"  Registry.registry_value_data = "*|LPort=*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid  Registry.dest Registry.user
   | `drop_dm_object_name(Registry)`
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`

detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml

@@ -34,7 +34,7 @@ tags:
   - T1021.001
   - T1021
   observable:
-  - name: user
+  - name: User
     type: User
     role:
     - Victim

detections/endpoint/allow_operation_with_consent_admin.yml

@@ -12,7 +12,7 @@ description: This analytic identifies a potential privilege escalation attempt t
   machine.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user
   | `drop_dm_object_name(Registry)`
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`

detections/endpoint/any_powershell_downloadfile.yml

@@ -14,7 +14,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*DownloadFile*
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
   `any_powershell_downloadfile_filter`'

detections/endpoint/any_powershell_downloadstring.yml

@@ -14,7 +14,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*.DownloadString*  by
-  Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
+  Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml

@@ -10,8 +10,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
   as process max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil`
-  (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `attempt_to_add_certificate_to_untrusted_store_filter`'
 how_to_implement: You must be ingesting data that records process activity from your

detections/endpoint/attempt_to_stop_security_service.yml

@@ -12,7 +12,7 @@ data_source:
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where `process_net` OR  Processes.process_name = sc.exe Processes.process="* stop
-  *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   |lookup security_services_lookup service as process OUTPUTNEW category, description

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   OR Processes.process_name=cmd* Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
   OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*
   OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*)
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name  Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `attempted_credential_dump_from_registry_via_reg_exe_filter`'

detections/endpoint/auto_admin_logon_registry_entry.yml

@@ -13,7 +13,7 @@ description: this search is to detect a suspicious registry modification to impl
   premise.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest
   | `drop_dm_object_name(Registry)`
   | where isnotnull(registry_value_data)
   | `security_content_ctime(firstTime)` 

detections/endpoint/bits_job_persistence.yml

@@ -18,7 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process
   IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*,
   *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.original_file_name
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/bitsadmin_download_file.yml

@@ -21,7 +21,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process
-  IN ("*transfer*", "*addfile*") by Processes.dest Processes.user Processes.parent_process
+  IN ("*transfer*", "*addfile*") by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
   Processes.original_file_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `bitsadmin_download_file_filter`'

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml

@@ -17,7 +17,7 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache*
   Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml

@@ -17,7 +17,7 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl*
   Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user
-  Processes.original_file_name Processes.parent_process Processes.process_name Processes.process
+  Processes.original_file_name Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/certutil_exe_certificate_extraction.yml

@@ -12,7 +12,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
-  Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process
+  Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `certutil_exe_certificate_extraction_filter`'

detections/endpoint/certutil_with_decode_argument.yml

@@ -17,7 +17,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*decode*
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_with_decode_argument_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/clop_ransomware_known_service_name.yml

@@ -12,7 +12,7 @@ description: This detection is to identify the common service name created by th
 data_source:
 - Sysmon Event ID 7
 search: '`wineventlog_system` EventCode=7045 Service_Name IN ("SecurityCenterIBM",
-  "WinCheckDRVs") | stats count min(_time) as firstTime max(_time) as lastTime by
+  "WinCheckDRVs") | stats count min(_time) as firstTime max(_time) as lastTime by dest
   EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `clop_ransomware_known_service_name_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -28,27 +28,14 @@ tags:
   asset_type: Endpoint
   confidence: 100
   impact: 100
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ executing known Clop Ransomware service names.
+  message: An instance of a known Clop Ransomware Service Name detected on $dest$
   mitre_attack_id:
   - T1543
   observable:
-  - name: user
-    type: User
-    role:
-    - Victim
   - name: dest
     type: Hostname
     role:
     - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/cmd_echo_pipe___escalation.yml

@@ -14,7 +14,7 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` OR Processes.process=*%comspec%*
   (Processes.process=*echo* AND Processes.process=*pipe*) by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.original_file_name Processes.process
+  Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml

@@ -13,7 +13,7 @@ data_source:
 search: '`sysmon` EventCode=7  ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll",
   "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*",
   "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime
-  by Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)`
+  by dest Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name and imageloaded executions from your endpoints. If you
@@ -31,23 +31,15 @@ tags:
   confidence: 100
   impact: 80
   message: The following module $ImageLoaded$ was loaded by a non-standard application
-    on endpoint $Computer$ by user $user$.
+    on endpoint $dest$
   mitre_attack_id:
   - T1218
   - T1218.003
   observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim
-  - name: ImageLoaded
-    type: Other
-    role:
-    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/cobalt_strike_named_pipes.yml

@@ -50,23 +50,18 @@ tags:
   asset_type: Endpoint
   confidence: 90
   impact: 80
-  message: An instance of $process_name$ was identified on endpoint $Computer$ by
-    user $user$ accessing known suspicious named pipes related to Cobalt Strike.
+  message: An instance of $process_name$ was identified on endpoint $dest$ accessing known suspicious named pipes related to Cobalt Strike.
   mitre_attack_id:
   - T1055
   observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim
   - name: process_name
     type: Process
     role:
-    - Parent Process
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/common_ransomware_extensions.yml

@@ -53,26 +53,6 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: file_name
-    type: File Name
-    role:
-    - Victim
-  - name: file_count
-    type: Other
-    role:
-    - Other
-  - name: path_count
-    type: Other
-    role:
-    - Other
-  - name: file_extension
-    type: Other
-    role:
-    - Other
-  - name: Name
-    type: Other
-    role:
-    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml

@@ -12,7 +12,7 @@ data_source:
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by
-  Processes.process Processes.process_name Processes.original_file_name Processes.dest
+  Processes.process Processes.process_name  Processes.parent_process_name Processes.original_file_name Processes.dest
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml

@@ -45,18 +45,10 @@ tags:
     type: User
     role:
     - Victim
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim
-  - name: TargetFilename
-    type: File Name
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml

@@ -12,7 +12,7 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_wmic` OR `process_powershell`
   Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name
-  Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
+  Processes.original_file_name Processes.parent_process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -46,14 +46,6 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml

@@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   OR Processes.process=*\\system32\\config\\security* OR Processes.process=*\\system32\\config\\system*
   OR Processes.process=*\\windows\\ntds\\ntds.dit*) by Processes.dest Processes.user
   Processes.process_name Processes.process  Processes.parent_process Processes.original_file_name
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  Processes.process_id Processes.parent_process_id  Processes.parent_process_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter` '
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -45,14 +45,6 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml

@@ -11,7 +11,7 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*mklink*
   Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest Processes.user Processes.process_name
-  Processes.process  Processes.parent_process Processes.original_file_name Processes.process_id
+  Processes.process  Processes.parent_process Processes.parent_process_name Processes.original_file_name Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
@@ -43,14 +43,6 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security