Merge pull request #2382 from splunk/story_name_fix

Throw Some D's

detections/endpoint/disable_defender_antivirus_registry.yml

@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This particular behavior is typically executed when an adversaries or
-  malware gains access to an endpoint and beings to perform execution and to evade
-  detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
+description: This particular behavior is typically executed when an adversary or
+  malware gains access to an endpoint and begins to perform execution and to evade
+  detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
@@ -33,7 +33,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   confidence: 70
   context:

detections/endpoint/disable_defender_blockatfirstseen_feature.yml

@@ -6,10 +6,10 @@ author: Teoderick Contreras
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious modification of registry to disable
-  windows defender feature. This technique is to bypassed or evade detection from
-  Windows Defender AV product specially the BlockAtFirstSeen feature where it block
-  suspicious file first seen in the host.
+description: This analytic is intended to detect a suspicious modification of the Windows registry to disable
+  a Windows Defender feature. This technique is intended to bypass or evade detection from
+  Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks
+  suspicious files the first time seen on the host.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
   = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by _time span=1h
@@ -32,7 +32,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   - Azorult
   confidence: 70

detections/endpoint/disable_defender_enhanced_notification.yml

@@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious modification of registry to disable
-  windows defender feature. This technique is to bypassed or evade detection from
-  Windows Defender AV product specially the Enhanced Notification feature wher user
-  or admin set to show or display alerts.
+description: This analytic is intended to detect a suspicious modification of registry to disable
+  windows defender features. This technique attempts to bypass or evade detection from
+  Windows Defender AV, specifically the Enhanced Notification feature where a user
+  or admin would receive alerts.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name
   = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by _time
@@ -32,7 +32,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   - Azorult
   confidence: 70

detections/endpoint/disable_defender_mpengine_registry.yml

@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This particular behavior is typically executed when an adversaries or
-  malware gains access to an endpoint and beings to perform execution and to evade
-  detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
+description: This particular behavior is typically executed when an adversary or
+  malware gains access to an endpoint and begins to perform execution and to evade
+  detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
@@ -33,7 +33,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   confidence: 70
   context:

detections/endpoint/disable_defender_spynet_reporting.yml

@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious modification of registry to disable
-  windows defender feature. This technique is to bypassed or evade detection from
-  Windows Defender AV product specially the spynet reporting for its telemetry.
+description: This analytic is intended to detect a suspicious modification of registry to disable
+  Windows Defender feature. This technique is intended to bypass or evade detection from
+  Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
   = SpynetReporting Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest
@@ -31,7 +31,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   - Azorult
   confidence: 70

detections/endpoint/disable_defender_submit_samples_consent_feature.yml

@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious modification of registry to disable
-  windows defender feature. This technique is to bypassed or evade detection from
-  Windows Defender AV product specially the submit samples feature for further analysis..
+description: This analytic is intended to detect a suspicious modification of the Windows registry to disable
+  a Windows Defender feature. This technique is intended to bypass or evade detection from
+  Windows Defender AV, specifically the feature that submits samples for further analysis.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
   = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by _time span=1h
@@ -31,7 +31,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   - Azorult
   confidence: 70

detections/endpoint/disable_schedule_task.yml

@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Endpoint
 description: This analytic is to detect a suspicious commandline to disable existing
-  schedule task. This technique is used by adversaries or commodity malware like IceID
+  schedule task. This technique is used by adversaries or commodity malware like IcedID
   to disable security application (AV products) in the targetted host to evade detections.
   This TTP is a good pivot to check further why and what other process run before
   and after this detection. check which process execute the commandline and what task

detections/endpoint/disabling_defender_services.yml

@@ -34,7 +34,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   confidence: 70
   context:

detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml

@@ -37,7 +37,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
-  - Iceid
+  - Icedid
   - Living Off The Land
   asset_type: Endpoint
   cis20:

detections/endpoint/suspicious_rundll32_plugininit.yml

@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Endpoint
 description: This search is to detect a suspicious rundll32.exe process with plugininit
-  parameter. This technique is commonly seen in IceID malware to execute its initial
+  parameter. This technique is commonly seen in IcedID malware to execute its initial
   dll stager to download another payload to the compromised machine.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*PluginInit*

detections/endpoint/windows_curl_download_to_suspicious_path.yml

@@ -34,7 +34,7 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Ingress Tool Transfer
   confidence: 100
   context:

detections/endpoint/wmic_noninteractive_app_uninstallation.yml

@@ -7,7 +7,7 @@ type: Hunting
 datamodel:
 - Endpoint
 description: This analytic indentifies WMIC command-line attempting to uninstall
-  application non-interactively. This technique was seen in IceID to uninstall AV
+  application non-interactively. This technique was seen in IcedID to uninstall AV
   products on the compromised host to evade detection. This Hunting
   query maybe a good indicator that some process tries to uninstall application using
   wmic which is not a common behavior. This approach may seen in some script or third
@@ -31,7 +31,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Azorult
   confidence: 50
   context:

detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml

@@ -32,7 +32,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   automated_detection_testing: passed
   confidence: 70
   context: