Fix dates, fields with spaces, and update verisons for many detections

2026-06-08 17:32:49 +00:00 · 2024-09-24 16:37:44 -07:00
parent 30aed85283
commit b43bb4fb4e
111 changed files with 330 additions and 330 deletions
@@ -1,7 +1,7 @@
 name: Okta Multiple Failed MFA Requests For User
 id: 826dbaae-a1e6-4c8c-b384-d16898956e73
-version: 2
-date: '2024-05-20'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 data_source: 
 - Okta
@@ -14,7 +14,7 @@ description: The following analytic identifies multiple failed multi-factor auth
  MFA by bombarding the user with repeated authentication requests, a technique used
  by threat actors like Lapsus and APT29. If confirmed malicious, this could lead
  to unauthorized access, potentially compromising sensitive information and systems.
-search: ' `okta` eventType=user.authentication.auth_via_mfa outcome.result=FAILURE
+search: '`okta` eventType=user.authentication.auth_via_mfa outcome.result=FAILURE
  debugContext.debugData.factor!=PASSWORD_AS_FACTOR | bucket _time span=5m | stats
  count min(_time) as firstTime max(_time) as lastTime values(displayMessage) values(src_ip)
  as src_ip values(debugContext.debugData.factor) by _time src_user | where count
@@ -1,14 +1,14 @@
 name: Windows AD Object Owner Updated
 id: 4af01f6b-d8d4-4f96-8635-758a01557130
-version: 1
-date: '2023-11-13'
+version: 2
+date: '2024-09-24'
 author: Dean Luxton
 status: production
 type: TTP
 data_source:
 - Windows Security 5136
 description: AD Object Owner Updated. The owner provides Full control level privileges over the target AD Object. This event has significant impact alone and is also a precursor activity for hiding an AD object. 
-search: ' `wineventlog_security` EventCode=5136 
+search: '`wineventlog_security` EventCode=5136 
  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName
  | rex field=old_value "O:(?P<old_owner>.*?)G:"
  | rex field=new_value "O:(?P<new_owner>.*?)G:"
@@ -1,7 +1,7 @@
 name: ASL AWS Concurrent Sessions From Different Ips
 id: b3424bbe-3204-4469-887b-ec144483a336
-version: 3
-date: '2024-05-24'
+version: 4
+date: '2024-09-24'
 author: Patrick Bareiss, Splunk
 status: production
 type: Anomaly
@@ -15,7 +15,7 @@ description: The following analytic identifies an AWS IAM account with concurren
  to sensitive corporate resources, leading to potential data breaches or further
  exploitation.
 data_source: []
-search: ' `amazon_security_lake` api.operation=DescribeEventAggregates src_endpoint.domain!="AWS Internal" 
+search: '`amazon_security_lake` api.operation=DescribeEventAggregates src_endpoint.domain!="AWS Internal" 
  | bin span=5m _time
  | stats values(src_endpoint.ip) as src_ip dc(src_endpoint.ip) as distinct_ip_count 
  by _time identity.user.credential_uid identity.user.name
@@ -1,7 +1,7 @@
 name: ASL AWS New MFA Method Registered For User
 id: 33ae0931-2a03-456b-b1d7-b016c5557fbd
-version: 3
-date: '2024-05-18'
+version: 4
+date: '2024-09-24'
 author: Patrick Bareiss, Splunk
 status: experimental
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic identifies the registration of a new Multi-F
  to secure their access, making it harder to detect and remove their presence from
  the compromised environment.
 data_source: []
-search: ' `amazon_security_lake` api.operation=CreateVirtualMFADevice | fillnull |
+search: '`amazon_security_lake` api.operation=CreateVirtualMFADevice | fillnull |
  stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.account_uid
  actor.user.name actor.user.uid http_request.user_agent src_endpoint.ip cloud.region
  | rename actor.user.name as user, src_endpoint.ip as src_ip, cloud.region as region,
@@ -1,7 +1,7 @@
 name: AWS Concurrent Sessions From Different Ips
 id: 51c04fdb-2746-465a-b86e-b413a09c9085
-version: 2
-date: '2024-05-15'
+version: 3
+date: '2024-09-24'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies an AWS IAM account with concurren
  exploitation within the AWS environment.
 data_source:
 - AWS CloudTrail DescribeEventAggregates
-search: ' `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal"
+search: '`cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal"
  | bin span=5m _time | stats values(userAgent) values(eventName) values(src_ip) as
  src_ip  dc(src_ip) as distinct_ip_count by _time user_arn | where distinct_ip_count
  > 1 | `aws_concurrent_sessions_from_different_ips_filter`'
@@ -1,7 +1,7 @@
 name: AWS New MFA Method Registered For User
 id: 4e3c26f2-4fb9-4bd7-ab46-1b76ffa2a23b
-version: 2
-date: '2024-05-13'
+version: 3
+date: '2024-09-24'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects the registration of a new Multi-Fact
  potentially leading to further unauthorized activities and data breaches.
 data_source:
 - AWS CloudTrail CreateVirtualMFADevice
-search: ' `cloudtrail` eventName=CreateVirtualMFADevice | stats count values(requestParameters.virtualMFADeviceName)
+search: '`cloudtrail` eventName=CreateVirtualMFADevice | stats count values(requestParameters.virtualMFADeviceName)
  as virtualMFADeviceName min(_time) as firstTime max(_time) as lastTime by eventSource
  aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn
  src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -1,7 +1,7 @@
 name: AWS Successful Console Authentication From Multiple IPs
 id: 395e50e1-2b87-4fa3-8632-0dfbdcbcd2cb
-version: 3
-date: '2024-05-26'
+version: 4
+date: '2024-09-24'
 author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
@@ -14,7 +14,7 @@ description: The following analytic detects an AWS account successfully authenti
  resources, leading to data breaches or further exploitation within the AWS environment.
 data_source:
 - AWS CloudTrail ConsoleLogin
-search: ' `cloudtrail` eventName = ConsoleLogin | bin span=5m _time | stats values(userAgent)
+search: '`cloudtrail` eventName = ConsoleLogin | bin span=5m _time | stats values(userAgent)
  as userAgent values(eventName) as eventName values(src_ip) as src_ip dc(src_ip)
  as distinct_ip_count by _time user_arn | where distinct_ip_count>1 | `aws_successful_console_authentication_from_multiple_ips_filter`'
 how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This
@@ -1,7 +1,7 @@
 name: AWS UpdateLoginProfile
 id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111
-version: 4
-date: '2024-05-17'
+version: 5
+date: '2024-09-24'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects an AWS CloudTrail event where a user
  resources within the AWS environment.
 data_source:
 - AWS CloudTrail UpdateLoginProfile
-search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com
+search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com
  errorCode = success | eval match=if(match(userIdentity.userName,requestParameters.userName),
  1,0) | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime
  by requestParameters.userName src eventName eventSource aws_account_id errorCode
@@ -1,7 +1,7 @@
 name: Azure Active Directory High Risk Sign-in
 id: 1ecff169-26d7-4161-9a7b-2ac4c8e61bea
-version: 3
-date: '2024-05-22'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects high-risk sign-in attempts against A
  exploitation within the environment.
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad` category=UserRiskEvents properties.riskLevel=high |
+search: '`azure_monitor_aad` category=UserRiskEvents properties.riskLevel=high |
  rename properties.* as * | stats count min(_time) as firstTime max(_time) as lastTime
  values(user) as user by src_ip, activity, riskLevel, riskEventType, additionalInfo
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_active_directory_high_risk_sign_in_filter`'
@@ -1,7 +1,7 @@
 name: Azure AD Application Administrator Role Assigned
 id: eac4de87-7a56-4538-a21b-277897af6d8d
-version: 3
-date: '2024-05-15'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies the assignment of the Application
  malicious, an attacker could escalate privileges, manage application settings, and
  potentially access sensitive resources by impersonating application identities,
  posing a significant security risk to the Azure AD tenant.
-search: ' `azure_monitor_aad`  "operationName"="Add member to role"  "properties.targetResources{}.modifiedProperties{}.newValue"="\"Application
+search: '`azure_monitor_aad`  "operationName"="Add member to role"  "properties.targetResources{}.modifiedProperties{}.newValue"="\"Application
  Administrator\"" | rename properties.* as * | rename initiatedBy.user.userPrincipalName
  as initiatedBy | stats count min(_time) as firstTime max(_time) as lastTime by user
  initiatedBy, result, operationName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -1,7 +1,7 @@
 name: Azure AD Authentication Failed During MFA Challenge
 id: e62c9c2e-bf51-4719-906c-3074618fcc1c
-version: 3
-date: '2024-05-18'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: 'The following analytic identifies failed authentication attempts a
  to unauthorized access and further compromise of the affected account.'
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad` category=SignInLogs properties.status.errorCode=500121
+search: '`azure_monitor_aad` category=SignInLogs properties.status.errorCode=500121
  | rename properties.* as * | stats count min(_time) as firstTime max(_time) as lastTime
  by user, src_ip, status.additionalDetails, appDisplayName, user_agent | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `azure_ad_authentication_failed_during_mfa_challenge_filter`'
@@ -1,7 +1,7 @@
 name: Azure AD Concurrent Sessions From Different Ips
 id: a9126f73-9a9b-493d-96ec-0dd06695490d
-version: 4
-date: '2024-08-05'
+version: 5
+date: '2024-09-24'
 author: Mauricio Velazco, Bhavin Patel, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects an Azure AD account with concurrent
  information and potential data breaches.
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs action=success 
+search: '`azure_monitor_aad` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs action=success 
 | rename properties.* as * 
 | bucket span=5m _time
 | stats count min(_time) as firstTime max(_time) as lastTime dc(src_ip) AS unique_ips dc(location.city) as dc_city values(location.city) as city values(src_ip) as src_ip values(appDisplayName) as appDisplayName values(location.countryOrRegion) by user _time 
@@ -1,7 +1,7 @@
 name: Azure AD High Number Of Failed Authentications For User
 id: 630b1694-210a-48ee-a450-6f79e7679f2c
-version: 3
-date: '2024-05-29'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies an Azure AD account experiencing
  based on their specific environment to reduce false positives.
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad` category= SignInLogs properties.status.errorCode=50126
+search: '`azure_monitor_aad` category= SignInLogs properties.status.errorCode=50126
  properties.authenticationDetails{}.succeeded=false | rename properties.* as * |
  bucket span=10m _time | stats count min(_time) as firstTime max(_time) as lastTime
  values(src_ip) as src_ip by user | where count > 20 | `security_content_ctime(firstTime)`
@@ -1,7 +1,7 @@
 name: Azure AD High Number Of Failed Authentications From Ip
 id: e5ab41bf-745d-4f72-a393-2611151afd8e
-version: 4
-date: '2024-08-05'
+version: 5
+date: '2024-09-24'
 author: Mauricio Velazco, Bhavin Patel, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects an IP address with 20 or more failed
  within the Azure environment.
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad` category= SignInLogs properties.status.errorCode=50126
+search: '`azure_monitor_aad` category= SignInLogs properties.status.errorCode=50126
  properties.authenticationDetails{}.succeeded=false | rename properties.* as * |
  bucket span=10m _time | stats count min(_time) as firstTime max(_time) as lastTime dc(user) AS unique_accounts values(user) as user by src_ip _time | where count > 20
 | `security_content_ctime(firstTime)` 
@@ -1,7 +1,7 @@
 name: Azure AD Multi-Source Failed Authentications Spike
 id: 116e11a9-63ea-41eb-a66a-6a13bdc7d2c7
-version: 3
-date: '2024-05-14'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: Hunting
@@ -16,7 +16,7 @@ description: The following analytic detects potential distributed password spray
  login attempts. If confirmed malicious, this could lead to unauthorized access,
  data breaches, privilege escalation, and lateral movement within the organization's
  infrastructure.
-search: ' `azure_monitor_aad` category=SignInLogs properties.status.errorCode=50126
+search: '`azure_monitor_aad` category=SignInLogs properties.status.errorCode=50126
  properties.authenticationDetails{}.succeeded=false | rename properties.* as * |
  bucket span=5m _time | eval uniqueIPUserCombo = src_ip . "-" . user | stats count
  min(_time) as firstTime max(_time) as lastTime dc(uniqueIPUserCombo) as uniqueIpUserCombinations,
@@ -1,7 +1,7 @@
 name: Azure AD Multiple AppIDs and UserAgents Authentication Spike
 id: 5d8bb1f0-f65a-4b4e-af2e-fcdb88276314
-version: 3
-date: '2024-05-26'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: Anomaly
@@ -15,7 +15,7 @@ description: The following analytic detects unusual authentication activity in A
  If confirmed malicious, it suggests a compromised account, potentially leading to
  further exploitation, lateral movement, and data exfiltration. Early detection is
  crucial to prevent substantial harm.
-search: ' `azure_monitor_aad` category=SignInLogs operationName="Sign-in activity"
+search: '`azure_monitor_aad` category=SignInLogs operationName="Sign-in activity"
  (properties.authenticationRequirement="multiFactorAuthentication" AND properties.status.additionalDetails="MFA
  required in Azure AD") OR (properties.authenticationRequirement=singleFactorAuthentication
  AND "properties.authenticationDetails{}.succeeded"=true) | bucket span=5m _time
@@ -1,7 +1,7 @@
 name: Azure AD Multiple Failed MFA Requests For User
 id: 264ea131-ab1f-41b8-90e0-33ad1a1888ea
-version: 4
-date: '2024-05-20'
+version: 5
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies multiple failed multi-factor auth
  within the environment.
 data_source:
 - Azure Active Directory Sign-in activity
-search: ' `azure_monitor_aad` category=SignInLogs operationName="Sign-in activity"
+search: '`azure_monitor_aad` category=SignInLogs operationName="Sign-in activity"
  properties.status.errorCode=500121 properties.status.additionalDetails!="MFA denied;
  user declined the authentication" | rename properties.* as * | bucket span=10m _time
  | stats count min(_time) as firstTime max(_time) as lastTime by user, status.additionalDetails,
@@ -1,7 +1,7 @@
 name: Azure AD Multiple Service Principals Created by SP
 id: 66cb378f-234d-4fe1-bb4c-e7878ff6b017
-version: 2
-date: '2024-05-13'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 data_source:
 - Azure Active Directory Add service principal
@@ -15,7 +15,7 @@ description: The following analytic detects when a single service principal in A
  establish multiple service principals, potentially staging an attack. If confirmed
  malicious, this activity could facilitate network infiltration or expansion, allowing
  the attacker to gain unauthorized access and persist within the environment.
-search: ' `azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.app.appId=*
+search: '`azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.app.appId=*
  | rename properties.* as * | bucket span=10m _time | rename targetResources{}.displayName
  as displayName | rename targetResources{}.type as type | rename initiatedBy.app.displayName
  as src_user | stats min(_time) as firstTime max(_time) as lastTime values(displayName)
@@ -1,7 +1,7 @@
 name: Azure AD Multiple Service Principals Created by User
 id: 32880707-f512-414e-bd7f-204c0c85b758
-version: 2
-date: '2024-05-13'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 data_source:
 - Azure Active Directory Add service principal
@@ -15,7 +15,7 @@ description: The following analytic identifies instances where a single user cre
  an attack or expand their foothold within the network. If confirmed malicious, this
  activity could allow attackers to establish persistence, escalate privileges, or
  access sensitive information within the Azure environment.
-search: ' `azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.user.id=*
+search: '`azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.user.id=*
  | rename properties.* as * | bucket span=10m _time | rename targetResources{}.displayName
  as displayName | stats min(_time) as firstTime max(_time) as lastTime values(displayName)
  as displayName dc(displayName) as unique_apps by src_user | where unique_apps >
@@ -1,7 +1,7 @@
 name: Azure AD Multiple Users Failing To Authenticate From Ip
 id: 94481a6a-8f59-4c86-957f-55a71e3612a6
-version: 3
-date: '2024-05-13'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: Anomaly
@@ -14,7 +14,7 @@ description: 'The following analytic detects a single source IP failing to authe
  access, data breaches, or privilege escalation within the Azure AD environment.'
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad`  category=SignInLogs properties.status.errorCode=50126
+search: '`azure_monitor_aad`  category=SignInLogs properties.status.errorCode=50126
  properties.authenticationDetails{}.succeeded=false | rename properties.* as * |
  bucket span=5m _time | stats count min(_time) as firstTime max(_time) as lastTime
  dc(user) AS unique_accounts values(user) as user by src_ip | where unique_accounts
@@ -1,7 +1,7 @@
 name: Azure AD New Custom Domain Added
 id: 30c47f45-dd6a-4720-9963-0bca6c8686ef
-version: 3
-date: '2024-05-14'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the addition of a new custom domain
  posing a severe security risk.
 data_source:
 - Azure Active Directory Add unverified domain
-search: ' `azure_monitor_aad`  operationName="Add unverified domain" properties.result=success
+search: '`azure_monitor_aad`  operationName="Add unverified domain" properties.result=success
  | rename properties.* as * | rename targetResources{}.displayName as domain | stats
  count min(_time) as firstTime max(_time) as lastTime by user, domain, result, operationName,
  src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -1,7 +1,7 @@
 name: Azure AD New Federated Domain Added
 id: a87cd633-076d-4ab2-9047-977751a3c1a0
-version: 3
-date: '2024-05-28'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects the addition of a new federated doma
  leading to unauthorized access and control over the Azure AD environment.
 data_source:
 - Azure Active Directory Set domain authentication
-search: ' `azure_monitor_aad`  operationName="Set domain authentication" "properties.result"=success
+search: '`azure_monitor_aad`  operationName="Set domain authentication" "properties.result"=success
  | rename properties.* as * | rename targetResources{}.displayName as domain | stats
  count min(_time) as firstTime max(_time) as lastTime by user, domain, result, operationName,
  src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -1,7 +1,7 @@
 name: Azure AD New MFA Method Registered For User
 id: 2628b087-4189-403f-9044-87403f777a1b
-version: 3
-date: '2024-05-29'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects the registration of a new Multi-Fact
  escalate their privileges within the environment.
 data_source:
 - Azure Active Directory User registered security info
-search: ' `azure_monitor_aad` category=AuditLogs operationName="User registered security
+search: '`azure_monitor_aad` category=AuditLogs operationName="User registered security
  info" properties.operationType=Add | rename properties.* as * | rename targetResources{}.*
  as * | stats count min(_time) as firstTime max(_time) as lastTime by user, resultDescription,
  result, src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -1,7 +1,7 @@
 name: Azure AD PIM Role Assigned
 id: fcd6dfeb-191c-46a0-a29c-c306382145ab
-version: 3
-date: '2024-05-14'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects the assignment of an Azure AD Privil
  monitored to prevent unauthorized access. If confirmed malicious, an attacker could
  exploit this to gain privileged access, potentially leading to unauthorized actions,
  data breaches, or further compromise of the environment.
-search: ' `azure_monitor_aad` operationName="Add eligible member to role in PIM completed*"
+search: '`azure_monitor_aad` operationName="Add eligible member to role in PIM completed*"
  | rename properties.* as * | stats count min(_time) as firstTime max(_time) as lastTime
  values(user) as user values(targetResources{}.displayName) as displayName  by result,
  operationName, initiatedBy.user.displayName | `security_content_ctime(firstTime)`
@@ -1,7 +1,7 @@
 name: Azure AD PIM Role Assignment Activated
 id: 952e80d0-e343-439b-83f4-808c3e6fbf2e
-version: 4
-date: '2024-05-25'
+version: 5
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the activation of an Azure AD Privil
  attempting to gain privileged access. If confirmed malicious, this could lead to
  unauthorized administrative actions, data breaches, or further compromise of the
  Azure environment.
-search: ' `azure_monitor_aad` operationName="Add member to role completed (PIM activation)"
+search: '`azure_monitor_aad` operationName="Add member to role completed (PIM activation)"
  | rename properties.* as * | rename initiatedBy.user.userPrincipalName as initiatedBy
  | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user
  values(targetResources{}.displayName) as displayName by initiatedBy, result, operationName
@@ -1,7 +1,7 @@
 name: Azure AD Privileged Authentication Administrator Role Assigned
 id: a7da845d-6fae-41cf-b823-6c0b8c55814a
-version: 3
-date: '2024-05-20'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the assignment of the Privileged Aut
  an attacker could change credentials and assume the identity and permissions of
  high-privilege users, potentially leading to unauthorized access to sensitive information
  and critical configurations.
-search: ' `azure_monitor_aad`  "operationName"="Add member to role"  "properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged
+search: '`azure_monitor_aad`  "operationName"="Add member to role"  "properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged
  Authentication Administrator\"" | rename properties.* as * | rename initiatedBy.user.userPrincipalName
  as initiatedBy | stats count min(_time) as firstTime max(_time) as lastTime values(user)
  as user by initiatedBy, result, operationName | `security_content_ctime(firstTime)`
@@ -1,7 +1,7 @@
 name: Azure AD Privileged Role Assigned
 id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a
-version: 3
-date: '2024-05-29'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects the assignment of privileged Azure A
  over the Azure AD infrastructure.
 data_source:
 - Azure Active Directory Add member to role
-search: ' `azure_monitor_aad`  "operationName"="Add member to role" | rename properties.*  as * 
+search: '`azure_monitor_aad`  "operationName"="Add member to role" | rename properties.*  as * 
  | rename initiatedBy.user.userPrincipalName as initiatedBy 
  | rename targetResources{}.modifiedProperties{}.newValue  as roles 
  | eval role=mvindex(roles,1)
@@ -1,7 +1,7 @@
 name: Azure AD Privileged Role Assigned to Service Principal
 id: 5dfaa3d3-e2e4-4053-8252-16d9ee528c41
-version: 3
-date: '2024-05-31'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: "The following analytic detects the assignment of privileged roles
  and ensures the security of Azure environments."
 data_source:
 - Azure Active Directory Add member to role
-search: ' `azure_monitor_aad`  operationName="Add member to role" 
+search: '`azure_monitor_aad`  operationName="Add member to role" 
  | rename properties.* as *
  | search "targetResources{}.type"=ServicePrincipal
  | rename initiatedBy.user.userPrincipalName as initiatedBy 
@@ -1,7 +1,7 @@
 name: Azure AD Service Principal Authentication
 id: 5a2ec401-60bb-474e-b936-1e66e7aa4060
-version: 2
-date: '2024-05-21'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 data_source:
 - Azure Active Directory Sign-in activity
@@ -16,7 +16,7 @@ description: The following analytic identifies authentication events of service
  or malicious activities. If confirmed malicious, attackers could gain unauthorized
  access to resources, leading to data breaches or further exploitation within the
  environment.
-search: ' `azure_monitor_aad` operationName="Sign-in activity" category=ServicePrincipalSignInLogs
+search: '`azure_monitor_aad` operationName="Sign-in activity" category=ServicePrincipalSignInLogs
  | rename properties.* as * | stats count earliest(_time) as firstTime latest(_time)
  as lastTime by user, user_id, src_ip, resourceDisplayName, resourceId | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `azure_ad_service_principal_authentication_filter`'
@@ -1,7 +1,7 @@
 name: Azure AD Service Principal New Client Credentials
 id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a
-version: 3
-date: '2024-05-11'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the addition of new credentials to S
  access and control over the Azure environment.
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad`  category=AuditLogs operationName="Update application*Certificates
+search: '`azure_monitor_aad`  category=AuditLogs operationName="Update application*Certificates
  and secrets management " | rename properties.* as * | rename  targetResources{}.*
  as * | stats count min(_time) as firstTime max(_time) as lastTime values(displayName)
  as displayName by user, modifiedProperties{}.newValue, src_ip | `security_content_ctime(firstTime)`
@@ -1,7 +1,7 @@
 name: Azure AD Service Principal Owner Added
 id: 7ddf2084-6cf3-4a44-be83-474f7b73c701
-version: 4
-date: '2024-05-28'
+version: 5
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the addition of a new owner to a Ser
  leading to unauthorized access and control over critical resources.
 data_source:
 - Azure Active Directory Add owner to application
-search: ' `azure_monitor_aad`  operationName="Add owner to application" | rename properties.*
+search: '`azure_monitor_aad`  operationName="Add owner to application" | rename properties.*
  as * | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.userPrincipalName
  as newOwner | rename targetResources{}.modifiedProperties{}.newValue as displayName
  | eval displayName = mvindex(displayName,1) | where initiatedBy!=newOwner | stats
@@ -1,7 +1,7 @@
 name: Azure AD Successful Authentication From Different Ips
 id: be6d868d-33b6-4aaa-912e-724fb555b11a
-version: 4
-date: '2024-05-26'
+version: 5
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects an Azure AD account successfully aut
  resources, leading to data breaches or further exploitation within the network.
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad`  properties.authenticationDetails{}.succeeded=true category=SignInLogs
+search: '`azure_monitor_aad`  properties.authenticationDetails{}.succeeded=true category=SignInLogs
  | rename properties.* as * | bucket span=30m _time | stats count min(_time) as firstTime
  max(_time) as lastTime dc(src_ip) AS unique_ips values(src_ip) as src_ip values(appDisplayName)
  as appDisplayName by user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -1,7 +1,7 @@
 name: Azure AD Successful PowerShell Authentication
 id: 62f10052-d7b3-4e48-b57b-56f8e3ac7ceb
-version: 3
-date: '2024-05-24'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies a successful authentication event
  or further exploitation within the Azure environment.
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad`  category=SignInLogs properties.authenticationDetails{}.succeeded=true
+search: '`azure_monitor_aad`  category=SignInLogs properties.authenticationDetails{}.succeeded=true
  properties.appDisplayName="Microsoft Azure PowerShell" | rename properties.*  as
  * | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user
  by src_ip, appDisplayName, user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -1,7 +1,7 @@
 name: Azure AD Successful Single-Factor Authentication
 id: a560e7f6-1711-4353-885b-40be53101fcd
-version: 3
-date: '2024-05-23'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic identifies a successful single-factor authen
  or further exploitation within the environment.
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad` category=SignInLogs properties.authenticationRequirement=singleFactorAuthentication
+search: '`azure_monitor_aad` category=SignInLogs properties.authenticationRequirement=singleFactorAuthentication
  properties.authenticationDetails{}.succeeded=true | rename properties.* as * | stats
  count min(_time) as firstTime max(_time) as lastTime values(user) as user by src_ip,
  appDisplayName, authenticationRequirement | `azure_ad_successful_single_factor_authentication_filter`'
@@ -1,7 +1,7 @@
 name: Azure AD Unusual Number of Failed Authentications From Ip
 id: 3d8d3a36-93b8-42d7-8d91-c5f24cec223d
-version: 3
-date: '2024-05-15'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: Anomaly
@@ -15,7 +15,7 @@ description: 'The following analytic identifies a single source IP failing to au
  compromise of sensitive information.'
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad`  category=SignInLogs properties.status.errorCode=50126
+search: '`azure_monitor_aad`  category=SignInLogs properties.status.errorCode=50126
  properties.authenticationDetails{}.succeeded=false | rename properties.* as * |
  bucket span=5m _time | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName)
  as userPrincipalName by _time, ipAddress | eventstats  avg(unique_accounts) as ip_avg,
@@ -1,7 +1,7 @@
 name: Azure AD User Consent Denied for OAuth Application
 id: bb093c30-d860-4858-a56e-cd0895d5b49c
-version: 3
-date: '2024-05-18'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -16,7 +16,7 @@ description: The following analytic identifies instances where a user has denied
  to gain access, potentially leading to data breaches or unauthorized actions within
  the environment. Understanding these denials helps refine security policies and
  enhance user awareness.
-search: ' `azure_monitor_aad` operationName="Sign-in activity" properties.status.errorCode=65004
+search: '`azure_monitor_aad` operationName="Sign-in activity" properties.status.errorCode=65004
  | rename properties.* as * | stats count min(_time) as firstTime max(_time) as lastTime
  by operationName, user, appDisplayName, status.failureReason | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `azure_ad_user_consent_denied_for_oauth_application_filter`'
@@ -1,7 +1,7 @@
 name: Azure AD User Enabled And Password Reset
 id: 1347b9e8-2daa-4a6f-be73-b421d3d9e268
-version: 3
-date: '2024-05-26'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -16,7 +16,7 @@ data_source:
 - Azure Active Directory Enable account 
 - Azure Active Directory Reset password (by admin) 
 - Azure Active Directory Update user
-search: ' `azure_monitor_aad`  (operationName="Enable account" OR operationName="Reset
+search: '`azure_monitor_aad`  (operationName="Enable account" OR operationName="Reset
  password (by admin)" OR operationName="Update user") | transaction user startsWith=(operationName="Enable
  account") endsWith=(operationName="Reset password (by admin)") maxspan=2m | rename
  properties.* as * | rename initiatedBy.user.userPrincipalName as initiatedBy | stats
@@ -1,7 +1,7 @@
 name: Azure AD User ImmutableId Attribute Updated
 id: 0c0badad-4536-4a84-a561-5ff760f3c00e
-version: 2
-date: '2024-05-24'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies the modification of the SourceAnc
  breaches.
 data_source:
 - Azure Active Directory Update user
-search: ' `azure_monitor_aad`  operationName="Update user" properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor
+search: '`azure_monitor_aad`  operationName="Update user" properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor
  | rename properties.* as * | rename initiatedBy.user.userPrincipalName as initiatedBy
  | rename targetResources{}.modifiedProperties{}.newValue as modifiedProperties |
  stats count min(_time) as firstTime max(_time) as lastTime values(user) as user
@@ -1,7 +1,7 @@
 name: Azure Automation Account Created
 id: 860902fd-2e76-46b3-b050-ba548dab576c
-version: 3
-date: '2024-05-24'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the creation of a new Azure Automati
  on virtual machines, posing a significant security risk.
 data_source:
 - Azure Audit Create or Update an Azure Automation account
-search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation
+search: '`azure_audit` operationName.localizedValue="Create or Update an Azure Automation
  account" status.value=Succeeded | dedup object | rename claims.ipaddr as src_ip
  | rename caller as user | stats count min(_time) as firstTime max(_time) as lastTime
  values(object) as object by user, src_ip, resourceGroupName, object_path | `security_content_ctime(firstTime)`
@@ -1,7 +1,7 @@
 name: Azure Automation Runbook Created
 id: 178d696d-6dc6-4ee8-9d25-93fee34eaf5b
-version: 3
-date: '2024-05-11'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the creation of a new Azure Automati
  environment.
 data_source:
 - Azure Audit Create or Update an Azure Automation Runbook
-search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation
+search: '`azure_audit` operationName.localizedValue="Create or Update an Azure Automation
  Runbook" object!=AzureAutomationTutorial* status.value=Succeeded | dedup object
  | rename claims.ipaddr as src_ip | rename caller as user | stats count min(_time)
  as firstTime max(_time) as lastTime by object user, src_ip, resourceGroupName, object_path
@@ -1,7 +1,7 @@
 name: Azure Runbook Webhook Created
 id: e98944a9-92e4-443c-81b8-a322e33ce75a
-version: 4
-date: '2024-05-23'
+version: 5
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the creation of a new Automation Run
  control over Azure resources.
 data_source:
 - Azure Audit Create or Update an Azure Automation webhook
-search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation
+search: '`azure_audit` operationName.localizedValue="Create or Update an Azure Automation
  webhook" status.value=Succeeded | dedup object | rename claims.ipaddr as src_ip
  | rename caller as user | stats count min(_time) as firstTime max(_time) as lastTime
  by object user, src_ip, resourceGroupName, object_path | `security_content_ctime(firstTime)`
@@ -1,7 +1,7 @@
 name: GCP Authentication Failed During MFA Challenge
 id: 345f7e1d-a3fe-4158-abd8-e630f9878323
-version: 3
-date: '2024-05-11'
+version: 4
+date: '2024-09-24'
 author: Bhavin Patel, Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: 'The following analytic detects failed authentication attempts duri
  GCP environment.'
 data_source:
 - Google Workspace login_failure
-search: ' `gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | stats
+search: '`gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | stats
  count min(_time) as firstTime max(_time) as lastTime by user, src_ip, login_challenge_method
  | `gcp_authentication_failed_during_mfa_challenge_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Google
@@ -1,7 +1,7 @@
 name: O365 Compliance Content Search Exported
 id: 2ce9f31d-ab4f-4179-b2b7-c77a9652e1d8
-version: 2
-date: '2024-05-24'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 data_source: []
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic identifies when the results of a content sea
  If confirmed malicious, an attacker could gain access to and exfiltrate sensitive
  information, posing a severe risk to the organization's data security and compliance
  posture.
-search: ' `o365_management_activity`  Workload=SecurityComplianceCenter Operation="SearchExported"
+search: '`o365_management_activity`  Workload=SecurityComplianceCenter Operation="SearchExported"
  | rename user_id as user | stats count earliest(_time) as firstTime latest(_time)
  as lastTime by Operation, ObjectId, ExchangeLocations, user, Query  |`security_content_ctime(firstTime)`
  |`security_content_ctime(lastTime)` | `o365_compliance_content_search_exported_filter`'
@@ -1,7 +1,7 @@
 name: O365 Compliance Content Search Started
 id: f4cabbc7-c19a-4e41-8be5-98daeaccbb50
-version: 2
-date: '2024-05-15'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 data_source: []
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects when a content search is initiated w
  unauthorized data access, potential data exfiltration, and compliance violations.
  Monitoring this behavior helps ensure the integrity and security of organizational
  data.
-search: ' `o365_management_activity` Workload=SecurityComplianceCenter Operation=SearchCreated
+search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=SearchCreated
  | rename user_id as user | stats count earliest(_time) as firstTime latest(_time)
  as lastTime by Operation, ObjectId, ExchangeLocations, user, Query  |`security_content_ctime(firstTime)`
  |`security_content_ctime(lastTime)` | `o365_compliance_content_search_started_filter`'
@@ -1,7 +1,7 @@
 name: O365 Concurrent Sessions From Different Ips
 id: 58e034de-1f87-4812-9dc3-a4f68c7db930
-version: 2
-date: '2024-05-27'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies user sessions in Office 365 acces
  posing severe risks to organizational security.
 data_source:
 - O365 UserLoggedIn
-search: ' `o365_management_activity` Workload=AzureActiveDirectory  Operation=UserLoggedIn
+search: '`o365_management_activity` Workload=AzureActiveDirectory  Operation=UserLoggedIn
  | stats min(_time) as firstTime max(_time) as lastTime values(src_ip) as ips values(user_agent)
  as user_agents by Operation, user, SessionId | where mvcount(ips) > 1 | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `o365_concurrent_sessions_from_different_ips_filter`'
@@ -1,7 +1,7 @@
 name: O365 Elevated Mailbox Permission Assigned
 id: 2246c142-a678-45f8-8546-aaed7e0efd30
-version: 2
-date: '2024-05-15'
+version: 3
+date: '2024-09-24'
 author: Patrick Bareiss, Mauricio Velazco, Splunk
 data_source: []
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic identifies the assignment of elevated mailbo
  over mailboxes, which could lead to data exfiltration or privilege escalation. If
  confirmed malicious, attackers could gain extensive access to sensitive email data
  and potentially manipulate mailbox settings, posing a severe security risk.
-search: ' `o365_management_activity` Workload=Exchange Operation=Add-MailboxPermission
+search: '`o365_management_activity` Workload=Exchange Operation=Add-MailboxPermission
  | search (AccessRights=FullAccess OR AccessRights=ChangePermission OR AccessRights=ChangeOwner)
  | rename Identity AS dest_user | stats count earliest(_time) as firstTime latest(_time)
  as lastTime by user dest_user Operation AccessRights |`security_content_ctime(firstTime)`
@@ -1,7 +1,7 @@
 name: O365 High Number Of Failed Authentications for User
 id: 31641378-2fa9-42b1-948e-25e281cb98f7
-version: 2
-date: '2024-05-16'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies an O365 account experiencing more
  access to the O365 environment, potentially compromising sensitive emails, documents,
  and other data. Prompt investigation and action are crucial to prevent unauthorized
  access and data breaches.
-search: ' `o365_management_activity` Operation=UserLoginFailed  record_type=AzureActiveDirectoryStsLogon
+search: '`o365_management_activity` Operation=UserLoginFailed  record_type=AzureActiveDirectoryStsLogon
  Workload=AzureActiveDirectory | bucket span=5m _time | stats  dc(_raw) AS failed_attempts  values(src_ip)
  as src_ip by user, _time | where failed_attempts > 10 | `o365_high_number_of_failed_authentications_for_user_filter`'
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest
@@ -1,7 +1,7 @@
 name: O365 Mailbox Folder Read Permission Granted
 id: cd15c0a8-470e-4b12-9517-046e4927db30
-version: 2
-date: '2024-05-25'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 data_source: []
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic identifies instances where read permissions
  exposing sensitive email content. If confirmed malicious, an attacker could gain
  unauthorized access to read email communications, leading to data breaches or information
  leakage.
-search: ' `o365_management_activity` Workload=Exchange (Operation="Set-MailboxFolderPermission"
+search: '`o365_management_activity` Workload=Exchange (Operation="Set-MailboxFolderPermission"
  OR Operation="Add-MailboxFolderPermission" ) | eval isReadRole=if(match(AccessRights,
  "^(ReadItems|Author|NonEditingAuthor|Owner|PublishingAuthor|Reviewer)$"), "true",
  "false") | search isReadRole="true" | rename UserId as user | stats count earliest(_time)
@@ -1,7 +1,7 @@
 name: O365 Multi-Source Failed Authentications Spike
 id: ea4e2c41-dbfb-4f5f-a7b6-9ac1b7f104aa
-version: 2
-date: '2024-05-31'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: Hunting
@@ -15,7 +15,7 @@ description: The following analytic identifies a spike in failed authentication
  If confirmed malicious, this activity could lead to unauthorized access, data breaches,
  privilege escalation, and lateral movement within the organization. Early detection
  is crucial to prevent account takeovers and mitigate subsequent threats.
-search: ' `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed
+search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed
  ErrorNumber=50126 | bucket span=5m _time | eval uniqueIPUserCombo = src_ip . "-"
  . user | stats dc(uniqueIPUserCombo) as uniqueIpUserCombinations, dc(user) as uniqueUsers,
  dc(src_ip) as uniqueIPs, values(user) as user, values(src_ip) as ips, values(user_agent)
@@ -1,7 +1,7 @@
 name: O365 Multiple AppIDs and UserAgents Authentication Spike
 id: 66adc486-224d-45c1-8e4d-9e7eeaba988f
-version: 2
-date: '2024-05-12'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: Anomaly
@@ -17,7 +17,7 @@ description: The following analytic identifies unusual authentication activity i
  it suggests a compromised account, potentially leading to unauthorized access, privilege
  escalation, and data exfiltration. Early detection is crucial to prevent further
  exploitation.
-search: ' `o365_management_activity` Workload=AzureActiveDirectory (Operation=UserLoggedIn
+search: '`o365_management_activity` Workload=AzureActiveDirectory (Operation=UserLoggedIn
  OR Operation=UserLoginFailed) | bucket span=5m _time | stats  dc(_raw) as failed_attempts
  dc(ApplicationId) as unique_app_ids dc(UserAgent) as unique_user_agents values(ApplicationId)
  values(OS) by _time user src_ip | where failed_attempts > 5 and unique_user_agents
@@ -1,7 +1,7 @@
 name: O365 Multiple Failed MFA Requests For User
 id: fd22124e-dbac-4744-a8ce-be10d8ec3e26
-version: 2
-date: '2024-05-26'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -16,7 +16,7 @@ description: The following analytic identifies potential "MFA fatigue" attacks t
  requests. If confirmed malicious, this could lead to data breaches, unauthorized
  data access, or further compromise within the O365 environment. Immediate investigation
  is crucial.
-search: ' `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed
+search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed
  ResultStatus=Success  ErrorNumber=500121 | bucket span=10m _time | stats  dc(_raw)
  as mfa_prompts values(LogonError) as LogonError values(signature) as signature by
  user, _time | where  mfa_prompts  > 9 | `o365_multiple_failed_mfa_requests_for_user_filter`'
@@ -16,7 +16,7 @@ description: The following analytic detects when a high number of Office 365 Exc
  information, leading to data breaches and further exploitation of compromised accounts.
  The threshold is set to flag over five unique mailboxes accessed within 10 minutes,
  but should be tailored to your environment.
-search: ' `o365_management_activity` Workload=Exchange Operation=MailItemsAccessed
+search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed
  AppId=* ClientAppId=* | bucket span=10m _time | eval matchRegex=if(match(ClientInfoString,
  "^Client=WebServices;ExchangeWebServices"), 1, 0) | search (AppId="00000003-0000-0000-c000-000000000000"
  OR matchRegex=1) | stats values(ClientIPAddress) as src_ip dc(user) as unique_mailboxes
@@ -1,7 +1,7 @@
 name: O365 Multiple Users Failing To Authenticate From Ip
 id: 8d486e2e-3235-4cfe-ac35-0d042e24ecb4
-version: 3
-date: '2024-05-23'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -16,7 +16,7 @@ description: The following analytic identifies instances where more than 10 uniq
  multiple accounts, potentially leading to unauthorized access. Immediate action
  is required to block or monitor the suspicious IP and notify affected users to enhance
  their security measures.
-search: ' `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed
+search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed
  ErrorNumber=50126 |  bucket span=5m _time |  stats dc(user) as unique_accounts values(user)
  as user values(LogonError) as LogonError values(signature) as signature values(UserAgent)
  as UserAgent by _time, src_ip |  where unique_accounts > 10 | `o365_multiple_users_failing_to_authenticate_from_ip_filter`'
@@ -1,7 +1,7 @@
 name: O365 OAuth App Mailbox Access via EWS
 id: e600cf1a-0bef-4426-b42e-00176d610a4d
-version: 2
-date: '2024-05-14'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 data_source:
@@ -15,7 +15,7 @@ description: The following analytic detects when emails are accessed in Office 3
  emails through EWS is crucial for identifying potential abuse or unauthorized data
  access. If confirmed malicious, this activity could lead to unauthorized email access,
  data exfiltration, or further compromise of sensitive information.
-search: ' `o365_management_activity` Workload=Exchange Operation=MailItemsAccessed
+search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed
  AppId=* ClientAppId=* | regex ClientInfoString="^Client=WebServices;ExchangeWebServices"
  |  stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress)
  as src_ip by user ClientAppId OperationCount AppId ClientInfoString | `security_content_ctime(firstTime)`
@@ -1,7 +1,7 @@
 name: O365 OAuth App Mailbox Access via Graph API
 id: 9db0d5b0-4058-4cb7-baaf-77d8143539a2
-version: 2
-date: '2024-05-18'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 data_source:
@@ -14,7 +14,7 @@ description: The following analytic detects when emails are accessed in Office 3
  access to emails can lead to data breaches and information theft. If confirmed malicious,
  attackers could exfiltrate sensitive information, compromise user accounts, and
  further infiltrate the organization’s network.
-search: ' `o365_management_activity` Workload=Exchange Operation=MailItemsAccessed
+search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed
  AppId=* AppId=00000003-0000-0000-c000-000000000000 |  stats count earliest(_time)
  as firstTime latest(_time) as lastTime values(ClientIPAddress) by user ClientAppId
  OperationCount AppId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -1,7 +1,7 @@
 name: O365 Security And Compliance Alert Triggered
 id: 5b367cdd-8dfc-49ac-a9b7-6406cf27f33e
-version: 2
-date: '2024-05-09'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 data_source: []
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies alerts triggered by the Office 36
  If confirmed malicious, these alerts could indicate attempts to breach security
  policies, leading to unauthorized access, data exfiltration, or other malicious
  activities.
-search: ' `o365_management_activity` Workload=SecurityComplianceCenter Category=ThreatManagement
+search: '`o365_management_activity` Workload=SecurityComplianceCenter Category=ThreatManagement
  Operation=AlertTriggered | spath input=Data path=f3u output=user | spath input=Data
  path=op output=operation | spath input=_raw path=wl | spath input=Data path=rid
  output=rule_id | spath input=Data path=ad output=alert_description | spath input=Data
@@ -1,7 +1,7 @@
 name: O365 Service Principal New Client Credentials
 id: a1b229e9-d962-4222-8c62-905a8a010453
-version: 2
-date: '2024-05-12'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the addition of new credentials for
  operations under the application's identity.
 data_source:
 - O365
-search: ' `o365_management_activity` Workload=AzureActiveDirectory Operation="Update
+search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Update
  application*Certificates and secrets management " |  stats earliest(_time) as firstTime
  latest(_time) as lastTime by user ModifiedProperties{}.NewValue object ObjectId
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_service_principal_new_client_credentials_filter`'
@@ -1,7 +1,7 @@
 name: O365 User Consent Denied for OAuth Application
 id: 2d8679ef-b075-46be-8059-c25116cb1072
-version: 2
-date: '2024-05-22'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -16,7 +16,7 @@ description: The following analytic identifies instances where a user has denied
  or unfamiliar applications. If confirmed malicious, it suggests an attempt by a
  potentially harmful application to gain unauthorized access, which was proactively
  blocked by the user.
-search: ' `o365_graph` status.errorCode=65004 | rename userPrincipalName as user |
+search: '`o365_graph` status.errorCode=65004 | rename userPrincipalName as user |
  rename ipAddress as src_ip | stats max(_time) as lastTime by user src_ip appDisplayName
  status.failureReason | `security_content_ctime(lastTime)` | `o365_user_consent_denied_for_oauth_application_filter`'
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest
@@ -1,7 +1,7 @@
 name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
 id: 114c6bfe-9406-11ec-bcce-acde48001122
-version: 3
-date: '2024-05-29'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the execution of the `Get-ADUser` Po
  privileges within the network.
 data_source:
 - Powershell Script Block Logging 4104
-search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*")
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*")
  | stats count min(_time)  as firstTime max(_time) as lastTime by Opcode Computer
  UserID EventCode ScriptBlockText | rename Computer as dest | `security_content_ctime(firstTime)`
  | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
@@ -1,7 +1,7 @@
 name: Disabled Kerberos Pre-Authentication Discovery With PowerView
 id: b0b34e2c-90de-11ec-baeb-acde48001122
-version: 3
-date: '2024-05-12'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the execution of the `Get-DomainUser
  privileges within the network.
 data_source:
 - Powershell Script Block Logging 4104
-search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*")
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*")
  | stats count min(_time)  as firstTime max(_time) as lastTime by Opcode Computer
  UserID EventCode ScriptBlockText | rename Computer as dest | `security_content_ctime(firstTime)`
  | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
@@ -1,7 +1,7 @@
 name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
 id: 0cb847ee-9423-11ec-b2df-acde48001122
-version: 2
-date: '2024-05-24'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects when the Kerberos Pre-Authentication
  of sensitive information.
 data_source:
 - Windows Event Log Security 4738
-search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require
+search: '`wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require
  Preauth'' - Enabled*" |rename Account_Name as user | table EventCode, user, dest,
  Security_ID, MSADChangedAttributes | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -1,7 +1,7 @@
 name: Kerberos Service Ticket Request Using RC4 Encryption
 id: 7d90f334-a482-11ec-908c-acde48001122
-version: 3
-date: '2024-05-27'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -16,7 +16,7 @@ description: 'The following analytic detects Kerberos service ticket requests us
  key instead of the NTLM hash.'
 data_source:
 - Windows Event Log Security 4769
-search: ' `wineventlog_security` EventCode=4769 ServiceName="*$" (TicketOptions=0x40810000
+search: '`wineventlog_security` EventCode=4769 ServiceName="*$" (TicketOptions=0x40810000
  OR TicketOptions=0x40800000 OR TicketOptions=0x40810010) TicketEncryptionType=0x17
  | stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id,
  TicketEncryptionType, TicketOptions | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
@@ -1,7 +1,7 @@
 name: Kerberos TGT Request Using RC4 Encryption
 id: 18916468-9c04-11ec-bdc6-acde48001122
-version: 3
-date: '2024-05-27'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects a Kerberos Ticket Granting Ticket (T
  potentially leading to lateral movement and further compromise within the network.
 data_source:
 - Windows Event Log Security 4768
-search: ' `wineventlog_security` EventCode=4768 TicketEncryptionType=0x17 ServiceName!=*$
+search: '`wineventlog_security` EventCode=4768 TicketEncryptionType=0x17 ServiceName!=*$
  | stats count min(_time) as firstTime max(_time) as lastTime by ServiceName src_ip
  dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `kerberos_tgt_request_using_rc4_encryption_filter`'
@@ -1,7 +1,7 @@
 name: Kerberos User Enumeration
 id: d82d4af4-a0bd-11ec-9445-3e22fbd008af
-version: 3
-date: '2024-05-25'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: Anomaly
@@ -14,7 +14,7 @@ description: The following analytic detects an unusual number of Kerberos Ticket
  or credential stuffing, compromising the security of the environment.
 data_source:
 - Windows Event Log Security 4768
-search: ' `wineventlog_security` EventCode=4768 Status=0x6 TargetUserName!="*$" |
+search: '`wineventlog_security` EventCode=4768 Status=0x6 TargetUserName!="*$" |
  bucket span=2m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName)
  as tried_accounts by _time, src_ip | eventstats avg(unique_accounts) as comp_avg
  , stdev(unique_accounts) as comp_std by src_ip | eval upperBound=(comp_avg+comp_std*3)
@@ -1,7 +1,7 @@
 name: Linux Auditd Add User Account Type
 id: f8c325ea-506e-4105-8ccf-da1492e90115
-version: 1
-date: '2024-09-04'
+version: 2
+date: '2024-09-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -14,7 +14,7 @@ description: The following analytic detects the suspicious add user account type
  early is essential to prevent potential security incidents.
 data_source:
 - Linux Auditd Add User
-search: ' `linux_auditd` type=ADD_USER | rename hostname as dest| stats count min(_time)
+search: '`linux_auditd` type=ADD_USER | rename hostname as dest| stats count min(_time)
  as firstTime max(_time) as lastTime by exe pid dest res UID type | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_type_filter`'
 how_to_implement: To implement this detection, the process begins by ingesting auditd
@@ -1,14 +1,14 @@
 name: Linux Auditd Database File And Directory Discovery
 id: f616c4f3-bde9-41cf-856c-019b65f668bb
-version: 1
-date: '2024-09-04'
+version: 2
+date: '2024-09-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
 description: "The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. This behavior is often a precursor to data theft, unauthorized access, or privilege escalation, as attackers seek to identify valuable information stored in databases. By monitoring for unusual or unauthorized attempts to locate database files and directories, this analytic aids in early detection of potential reconnaissance or data breach efforts, enabling security teams to respond swiftly and mitigate the risk of further compromise."
 data_source:
 - Linux Auditd Execve
-search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as
+search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as
  dest | where  (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND
  (LIKE (process_exec, "%.db%") OR LIKE (process_exec, "%.sql%") OR LIKE (process_exec,
  "%.sqlite%") OR LIKE (process_exec, "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR
@@ -1,14 +1,14 @@
 name: Linux Auditd Find Private Keys
 id: 80bb9988-190b-4ee0-a3c3-509545a8f678
-version: 1
-date: '2024-09-04'
+version: 2
+date: '2024-09-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
 description: "The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for private keys, this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information."
 data_source:
 - Linux Auditd Execve
-search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as
+search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as
  dest | where  (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND
  (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec,
  "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE
@@ -1,7 +1,7 @@
 name: Linux Auditd Hidden Files And Directories Creation
 id: 555cc358-bf16-4e05-9b3a-0f89c73b7261
-version: 1
-date: '2024-09-04'
+version: 2
+date: '2024-09-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -16,7 +16,7 @@ description: "The following analytic detects suspicious creation of hidden files
  and address hidden threats effectively."
 data_source:
 - Linux Auditd Execve
-search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as
+search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as
  dest | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR
  LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano
  %")) AND (LIKE (process_exec,"% ./.%")  OR LIKE (process_exec," .%")OR LIKE (process_exec,"
@@ -1,14 +1,14 @@
 name: Linux Auditd Virtual Disk File And Directory Discovery
 id: eec78cef-d4c8-4b35-8f5b-6922102a4a41
-version: 1
-date: '2024-09-04'
+version: 2
+date: '2024-09-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
 description: "The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. Virtual disks can contain sensitive data or critical system configurations, and unauthorized discovery attempts could signify preparatory actions for data exfiltration or further compromise. By monitoring for unusual or unauthorized searches for virtual disk files and directories, this analytic helps identify potential reconnaissance activities, enabling security teams to respond promptly and safeguard against unauthorized access and data breaches."
 data_source:
 - Linux Auditd Execve
-search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as
+search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as
  dest | where  (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND
  (LIKE (process_exec, "%.vhd%") OR LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec,
  "%.vmdk%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc
@@ -1,7 +1,7 @@
 name: Malicious Powershell Executed As A Service
 id: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8
-version: 3
-date: '2024-05-20'
+version: 4
+date: '2024-09-24'
 author: Ryan Becwar
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies the execution of malicious PowerS
  persistence within the environment.
 data_source:
 - Windows Event Log System 7045
-search: ' `wineventlog_system` EventCode=7045 | eval l_ImagePath=lower(ImagePath)
+search: '`wineventlog_system` EventCode=7045 | eval l_ImagePath=lower(ImagePath)
  | regex l_ImagePath="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]"
  | regex l_ImagePath="-nop[rofile\s]+|-w[indowstyle]*\s+hid[den]*|-noe[xit\s]+|-enc[odedcommand\s]+"
  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ImagePath
@@ -1,7 +1,7 @@
 name: Randomly Generated Scheduled Task Name
 id: 9d22a780-5165-11ec-ad4f-3e22fbd008af
-version: 2
-date: '2024-05-28'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: experimental
 type: Hunting
@@ -15,7 +15,7 @@ description: The following analytic detects the creation of a Scheduled Task wit
  the network.
 data_source:
 - Windows Event Log Security 4698
-search: ' `wineventlog_security` EventCode=4698 | xmlkv Message | lookup ut_shannon_lookup
+search: '`wineventlog_security` EventCode=4698 | xmlkv Message | lookup ut_shannon_lookup
  word as Task_Name | where ut_shannon > 3 | table  _time, dest, Task_Name, ut_shannon,
  Command, Author, Enabled, Hidden | `randomly_generated_scheduled_task_name_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -1,7 +1,7 @@
 name: Randomly Generated Windows Service Name
 id: 2032a95a-5165-11ec-a2c3-3e22fbd008af
-version: 3
-date: '2024-08-19'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: experimental
 type: Hunting
@@ -14,7 +14,7 @@ description: The following analytic detects the installation of a Windows Servic
  arbitrary code, escalate privileges, or maintain persistence within the environment.
 data_source:
 - Windows Event Log System 7045
-search: ' `wineventlog_system` EventCode=7045 | lookup ut_shannon_lookup word as Service_Name
+search: '`wineventlog_system` EventCode=7045 | lookup ut_shannon_lookup word as Service_Name
  | where ut_shannon > 3 | table EventCode ComputerName Service_Name ut_shannon Service_Start_Type
  Service_Type Service_File_Name | `randomly_generated_windows_service_name_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -1,7 +1,7 @@
 name: Rubeus Kerberos Ticket Exports Through Winlogon Access
 id: 5ed8c50a-8869-11ec-876f-acde48001122
-version: 3
-date: '2024-08-14'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects a process accessing the winlogon.exe
  and persist within the network, posing a severe security risk.
 data_source:
 - Sysmon EventID 10
-search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff)
+search: '`sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff)
  (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe
  AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe
  AND SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) | stats count min(_time)
@@ -1,7 +1,7 @@
 name: Short Lived Scheduled Task
 id: 6fa31414-546e-11ec-adfa-acde48001122
-version: 2
-date: '2024-05-17'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -16,7 +16,7 @@ description: 'The following analytic detects the creation and deletion of schedu
 data_source:
 - Windows Event Log Security 4698
 - Windows Event Log Security 4699
-search: ' `wineventlog_security` EventCode=4698 OR EventCode=4699 | xmlkv Message
+search: '`wineventlog_security` EventCode=4698 OR EventCode=4699 | xmlkv Message
  | transaction Task_Name  startswith=(EventCode=4698) endswith=(EventCode=4699) |
  eval short_lived=case((duration<30),"TRUE") | search  short_lived = TRUE | rename
  ComputerName as dest| table _time, dest, Account_Name, Command, Task_Name, short_lived
@@ -1,7 +1,7 @@
 name: Suspicious Kerberos Service Ticket Request
 id: 8b1297bc-6204-11ec-b7c4-acde48001122
-version: 3
-date: '2024-05-16'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects suspicious Kerberos Service Ticket (
  and unauthorized access to sensitive information.
 data_source:
 - Windows Event Log Security 4769
-search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(ServiceName)
+search: '`wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(ServiceName)
  = lower(mvindex(split(TargetUserName,"@"),0)),1,0) | where isSuspicious = 1 | rename
  Computer as dest| rename TargetUserName as user | table _time, dest, src_ip, user,
  ServiceName, Error_Code, isSuspicious | `suspicious_kerberos_service_ticket_request_filter`'
@@ -1,7 +1,7 @@
 name: Suspicious Ticket Granting Ticket Request
 id: d77d349e-6269-11ec-9cfe-acde48001122
-version: 3
-date: '2024-05-25'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: Hunting
@@ -16,7 +16,7 @@ description: The following analytic detects suspicious Kerberos Ticket Granting
 data_source:
 - Windows Event Log Security 4768
 - Windows Event Log Security 4781
-search: ' `wineventlog_security` (EventCode=4781 OldTargetUserName="*$" NewTargetUserName!="*$")
+search: '`wineventlog_security` (EventCode=4781 OldTargetUserName="*$" NewTargetUserName!="*$")
  OR (EventCode=4768 TargetUserName!="*$") | eval RenamedComputerAccount = coalesce(NewTargetUserName,
  TargetUserName) | transaction RenamedComputerAccount startswith=(EventCode=4781)
  endswith=(EventCode=4768) | eval short_lived=case((duration<2),"TRUE") | search
@@ -1,7 +1,7 @@
 name: Unusual Number of Computer Service Tickets Requested
 id: ac3b81c0-52f4-11ec-ac44-acde48001122
-version: 2
-date: '2024-05-25'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: experimental
 type: Hunting
@@ -15,7 +15,7 @@ description: 'The following analytic identifies an unusual number of computer se
  exfiltration.'
 data_source:
 - Windows Event Log Security 4769
-search: ' `wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*"
+search: '`wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*"
  | bucket span=2m _time | stats dc(Service_Name) AS unique_targets values(Service_Name)
  as host_targets by _time, Client_Address, Account_Name | eventstats avg(unique_targets)
  as comp_avg , stdev(unique_targets) as comp_std by Client_Address, Account_Name
@@ -1,7 +1,7 @@
 name: Unusual Number of Kerberos Service Tickets Requested
 id: eb3e6702-8936-11ec-98fe-acde48001122
-version: 3
-date: '2024-05-15'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: Anomaly
@@ -14,7 +14,7 @@ description: 'The following analytic identifies an unusual number of Kerberos se
  to sensitive accounts and escalation of privileges within the Active Directory environment.'
 data_source:
 - Windows Event Log Security 4769
-search: ' `wineventlog_security` EventCode=4769 ServiceName!="*$" TicketEncryptionType=0x17
+search: '`wineventlog_security` EventCode=4769 ServiceName!="*$" TicketEncryptionType=0x17
  | bucket span=2m _time | stats dc(ServiceName) AS unique_services values(ServiceName)
  as requested_services by _time, src | eventstats avg(unique_services) as comp_avg
  , stdev(unique_services) as comp_std by src | eval upperBound=(comp_avg+comp_std*3)
@@ -1,7 +1,7 @@
 name: Unusual Number of Remote Endpoint Authentication Events
 id: acb5dc74-5324-11ec-a36d-acde48001122
-version: 2
-date: '2024-05-11'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: experimental
 type: Hunting
@@ -14,7 +14,7 @@ description: 'The following analytic identifies an unusual number of remote auth
  escalate privileges, or gather information for further attacks.'
 data_source:
 - Windows Event Log Security 4624
-search: ' `wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$" |
+search: '`wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$" |
  eval Source_Account = mvindex(Account_Name, 1) | bucket span=2m _time | stats dc(ComputerName)
  AS unique_targets values(ComputerName) as target_hosts by _time, Source_Network_Address,
  Source_Account | eventstats avg(unique_targets) as comp_avg , stdev(unique_targets)
@@ -1,7 +1,7 @@
 name: Windows AD ServicePrincipalName Added To Domain Account
 id: 8a1259cb-0ea7-409c-8bfe-74bad89259f9
-version: 3
-date: '2024-05-22'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 type: TTP
 status: production
@@ -14,7 +14,7 @@ description: The following analytic detects the addition of a Service Principal
  and crack service account passwords offline. If confirmed malicious, this could
  allow an attacker to obtain cleartext passwords, leading to unauthorized access
  and potential lateral movement within the domain environment.
-search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName
+search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName
  OperationType="%%14674" | stats values(ObjectDN) as ObjectDN by _time, Computer,
  SubjectUserName, AttributeValue | rename Computer as dest SubjectUserName as user
  | `windows_ad_serviceprincipalname_added_to_domain_account_filter`'
@@ -1,7 +1,7 @@
 name: Windows AD Short Lived Domain Account ServicePrincipalName
 id: b681977c-d90c-4efc-81a5-c58f945fb541
-version: 2
-date: '2024-05-18'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 type: TTP
 status: production
@@ -15,7 +15,7 @@ description: The following analytic identifies the addition and quick deletion o
  of a domain account offline. If confirmed malicious, this could allow an attacker
  to gain unauthorized access to sensitive information or escalate privileges within
  the domain environment.
-search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName
+search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName
  | transaction ObjectDN AttributeValue startswith=(EventCode=5136 OperationType="%%14674")
  endswith=(EventCode=5136 OperationType="%%14675") | eval short_lived=case((duration<300),"TRUE")
  | search short_lived = TRUE | rename ObjectDN as user | `windows_ad_short_lived_domain_account_serviceprincipalname_filter`'
@@ -1,7 +1,7 @@
 name: Windows AD Short Lived Server Object
 id: 193769d3-1e33-43a9-970e-ad4a88256cdb
-version: 2
-date: '2024-05-21'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 type: TTP
 status: production
@@ -16,7 +16,7 @@ description: 'The following analytic identifies the creation and quick deletion
  rogue DC, enabling unauthorized changes to AD objects, including credentials. If
  confirmed malicious, this could lead to unauthorized AD modifications, compromising
  the integrity and security of the entire domain.'
-search: ' `wineventlog_security` EventCode=5137 OR EventCode=5141 ObjectDN="*CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration*"
+search: '`wineventlog_security` EventCode=5137 OR EventCode=5141 ObjectDN="*CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration*"
  | transaction ObjectDN startswith=(EventCode=5137) endswith=(EventCode=5141) | eval
  short_lived=case((duration<30),"TRUE") | search short_lived = TRUE | stats values(ObjectDN)
  values(signature) values(EventCode) by _time, Computer, SubjectUserName | `windows_ad_short_lived_server_object_filter`'
@@ -1,7 +1,7 @@
 name: Windows AD SID History Attribute Modified
 id: 1155e47d-307f-4247-beab-71071e3a458c
-version: 2
-date: '2024-05-16'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 type: TTP
 status: production
@@ -15,7 +15,7 @@ description: The following analytic detects modifications to the SID History att
  unauthorized access. If confirmed malicious, this activity could allow attackers
  to maintain persistent access and escalate privileges within the domain, posing
  a significant security risk.
-search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=sIDHistory
+search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=sIDHistory
  OperationType="%%14674" | stats values(ObjectDN) as ObjectDN by _time, Computer,
  SubjectUserName, AttributeValue | rename Computer as dest | `windows_ad_sid_history_attribute_modified_filter`'
 how_to_implement: To successfully implement this search, you ned to be ingesting eventcode
@@ -1,7 +1,7 @@
 name: Windows Administrative Shares Accessed On Multiple Hosts
 id: d92f2d95-05fb-48a7-910f-4d3d61ab8655
-version: 2
-date: '2024-05-19'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 type: TTP
 status: production
@@ -15,7 +15,7 @@ description: The following analytic detects a source computer accessing Windows
  a common tactic used by threat actors. If confirmed malicious, this activity could
  lead to unauthorized access to critical data, lateral movement, and potential compromise
  of multiple systems within the network.
-search: ' `wineventlog_security` EventCode=5140 OR EventCode=5145 (ShareName="\\\\*\\ADMIN$"
+search: '`wineventlog_security` EventCode=5140 OR EventCode=5145 (ShareName="\\\\*\\ADMIN$"
  OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$") | bucket span=5m _time | stats
  dc(Computer) AS unique_targets values(Computer) as host_targets values(ShareName)
  as shares by _time, IpAddress, SubjectUserName, EventCode | where unique_targets
@@ -1,7 +1,7 @@
 name: Windows Admon Default Group Policy Object Modified
 id: 83458004-db60-4170-857d-8572f16f070b
-version: 2
-date: '2024-05-28'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects modifications to the default Group P
  persistence, or deploy malware across multiple hosts. If confirmed malicious, such
  modifications could lead to widespread policy enforcement changes, unauthorized
  access, and potential compromise of the entire domain environment.
-search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*"
+search: '`admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*"
  (displayName="Default Domain Policy" OR displayName="Default Domain Controllers
  Policy") | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath)
  by dcName, displayName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -1,7 +1,7 @@
 name: Windows Admon Group Policy Object Created
 id: 69201633-30d9-48ef-b1b6-e680805f0582
-version: 2
-date: '2024-05-20'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects the creation of a new Group Policy O
  across an Active Directory network. If confirmed malicious, this activity could
  allow attackers to control system configurations, deploy ransomware, or propagate
  malware, significantly compromising the network's security.
-search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*"
+search: '`admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*"
  versionNumber=0 displayName!="New Group Policy Object" | stats min(_time) as firstTime
  max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `windows_admon_group_policy_object_created_filter`'
@@ -1,7 +1,7 @@
 name: Windows Default Group Policy Object Modified
 id: fe6a6cc4-9e0d-4d66-bcf4-2c7f44860876
-version: 2
-date: '2024-05-26'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -16,7 +16,7 @@ description: The following analytic detects modifications to default Group Polic
  across the network. If confirmed malicious, such modifications could lead to widespread
  compromise, allowing attackers to maintain control and execute arbitrary code on
  numerous hosts.
-search: ' `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=versionNumber
+search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=versionNumber
  (ObjectDN="CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=*"
  OR ObjectDN="CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=POLICIES,CN=SYSTEM,DC=*")
  | stats min(_time) as firstTime max(_time) as lastTime by ObjectDN SubjectUserSid
@@ -1,7 +1,7 @@
 name: Windows DnsAdmins New Member Added
 id: 27e600aa-77f8-4614-bc80-2662a67e2f48
-version: 4
-date: '2024-05-29'
+version: 5
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the addition of a new member to the
  privileges. If confirmed malicious, this activity could allow an attacker to escalate
  privileges and gain control over critical domain services, posing a significant
  security risk.
-search: ' `wineventlog_security` EventCode=4732 TargetUserName=DnsAdmins | stats min(_time)
+search: '`wineventlog_security` EventCode=4732 TargetUserName=DnsAdmins | stats min(_time)
  as firstTime max(_time) as lastTime values(TargetUserName) as target_users_added
  values(user) as user by  dest src_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_dnsadmins_new_member_added_filter`'
@@ -1,14 +1,14 @@
 name: Windows Domain Admin Impersonation Indicator
 id: 10381f93-6d38-470a-9c30-d25478e3bd3f
-version: 2
-date: '2024-05-12'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
 data_source:
 - Windows Event Log Security 4627
 description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges.
-search: ' `wineventlog_security`  EventCode=4627 LogonType=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") 
+search: '`wineventlog_security`  EventCode=4627 LogonType=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") 
  | where match(GroupMembership, "Domain Admins") 
  | stats  count by _time, TargetUserName, GroupMembership, host
  | lookup domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA username
@@ -1,7 +1,7 @@
 name: Windows ESX Admins Group Creation Security Event
 id: 53b4c927-5ec4-47cd-8aed-d4b303304f87
-version: 1
-date: '2024-07-30'
+version: 2
+date: '2024-09-24'
 author: Michael Haag, Splunk
 data_source:
 - Windows Event Log Security 4727
@@ -10,7 +10,7 @@ data_source:
 type: TTP
 status: production
 description: This analytic detects creation, deletion, or modification of the "ESX Admins" group in Active Directory. These events may indicate attempts to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085).
-search: ' `wineventlog_security` EventCode IN (4727, 4730, 4737) 
+search: '`wineventlog_security` EventCode IN (4727, 4730, 4737) 
  (TargetUserName="ESX Admins" OR TargetUserName="*ESX Admins*")
  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode TargetUserName TargetDomainName SubjectUserName SubjectDomainName Computer
  | rename Computer as dest
@@ -1,7 +1,7 @@
 name: Windows Get-AdComputer Unconstrained Delegation Discovery
 id: c8640777-469f-4638-ab44-c34a3233ffac
-version: 3
-date: '2024-05-13'
+version: 4
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the use of the Get-ADComputer cmdlet
  or lateral movement within the network.
 data_source:
 - Powershell Script Block Logging 4104
-search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADComputer*" AND ScriptBlockText
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-ADComputer*" AND ScriptBlockText
  = "*TrustedForDelegation*") | stats count min(_time) as firstTime max(_time) as
  lastTime by EventCode ScriptBlockText Computer UserID | rename Computer as dest
  | rename UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -1,7 +1,7 @@
 name: Windows Group Policy Object Created
 id: 23add2a8-ea22-4fd4-8bc0-8c0b822373a1
-version: 2
-date: '2024-05-17'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic detects the creation of a new Group Policy O
  across an Active Directory network. If confirmed malicious, this activity could
  allow attackers to control system configurations, deploy ransomware, or propagate
  malware, leading to widespread compromise and significant operational disruption.
-search: ' `wineventlog_security` EventCode=5137 OR (EventCode=5136 AttributeValue!="New
+search: '`wineventlog_security` EventCode=5137 OR (EventCode=5136 AttributeValue!="New
  Group Policy Object" AND (AttributeLDAPDisplayName=displayName OR AttributeLDAPDisplayName=gPCFileSysPath)
  ) ObjectClass=groupPolicyContainer | stats values(AttributeValue) as details values(SubjectUserSid)
  as User values(ObjectDN) as ObjectDN by ObjectGUID Computer | eval GPO_Name = mvindex(details,
@@ -1,7 +1,7 @@
 name: Windows Large Number of Computer Service Tickets Requested
 id: 386ad394-c9a7-4b4f-b66f-586252de20f0
-version: 2
-date: '2024-05-11'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 type: Anomaly
 status: production
@@ -15,7 +15,7 @@ description: The following analytic detects a high volume of Kerberos service ti
  or reconnaissance. If confirmed malicious, an attacker could gain unauthorized access
  to multiple endpoints, potentially compromising the entire network.

-search: ' `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$"
+search: '`wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$"
  | bucket span=5m _time | stats dc(ServiceName) AS unique_targets values(ServiceName)
  as host_targets by _time, IpAddress, TargetUserName | where unique_targets > 30
  | `windows_large_number_of_computer_service_tickets_requested_filter`'
@@ -1,7 +1,7 @@
 name: Windows Local Administrator Credential Stuffing
 id: 09555511-aca6-484a-b6ab-72cd03d73c34
 version: 2
-date: '2024-05-16'
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 type: TTP
 status: production
@@ -16,7 +16,7 @@ description: The following analytic detects attempts to authenticate using the b
  to privilege escalation. If confirmed malicious, this could allow the attacker to
  gain widespread access and control over numerous systems within the network, posing
  a severe security risk.
-search: ' `wineventlog_security` EventCode=4625 OR EventCode=4624 Logon_Type=3 TargetUserName=Administrator
+search: '`wineventlog_security` EventCode=4625 OR EventCode=4624 Logon_Type=3 TargetUserName=Administrator
  | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as
  host_targets by _time, IpAddress, TargetUserName, EventCode | where unique_targets
  > 30 | `windows_local_administrator_credential_stuffing_filter`'
@@ -1,7 +1,7 @@
 name: Windows Multiple Account Passwords Changed
 id: faefb681-14be-4f0d-9cac-0bc0160c7280
-version: 2
-date: '2024-05-19'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 data_source:
 - Windows Event Log Security 4724
@@ -15,7 +15,7 @@ description: The following analytic detects instances where more than five uniqu
  unauthorized access or internal compromise. If confirmed malicious, this activity
  could lead to widespread account compromise, unauthorized access to sensitive information,
  and potential disruption of services.
-search: ' `wineventlog_security` EventCode=4724 status=success | bucket span=10m _time
+search: '`wineventlog_security` EventCode=4724 status=success | bucket span=10m _time
  | stats count dc(user) as unique_users values(user) as user by EventCode signature
  _time src_user SubjectDomainName TargetDomainName Logon_ID | where unique_users
  > 5 | `windows_multiple_account_passwords_changed_filter`'
@@ -1,7 +1,7 @@
 name: Windows Multiple Accounts Deleted
 id: 49c0d4d6-c55d-4d3a-b3d5-7709fafed70d
-version: 2
-date: '2024-05-21'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 data_source:
 - Windows Event Log Security 4726
@@ -14,7 +14,7 @@ description: The following analytic detects the deletion of more than five uniqu
  is significant as it may indicate an attacker attempting to erase traces of their
  actions. If confirmed malicious, this could lead to unauthorized access removal,
  hindering incident response and forensic investigations.
-search: ' `wineventlog_security` EventCode=4726 status=success | bucket span=10m _time
+search: '`wineventlog_security` EventCode=4726 status=success | bucket span=10m _time
  | stats count dc(user) as unique_users values(user) as user by EventCode signature
  _time src_user SubjectDomainName TargetDomainName Logon_ID | where unique_users
  > 5 | `windows_multiple_accounts_deleted_filter`'
@@ -1,7 +1,7 @@
 name: Windows Multiple Accounts Disabled
 id: 5d93894e-befa-4429-abde-7fc541020b7b
-version: 2
-date: '2024-05-12'
+version: 3
+date: '2024-09-24'
 author: Mauricio Velazco, Splunk
 data_source:
 - Windows Event Log Security 4725
@@ -15,7 +15,7 @@ description: The following analytic identifies instances where more than five un
  breaches or an external attacker's attempt to disrupt operations. If confirmed malicious,
  this activity could lead to widespread account lockouts, hindering user access and
  potentially disrupting business operations.
-search: ' `wineventlog_security` EventCode=4725 status=success | bucket span=10m _time
+search: '`wineventlog_security` EventCode=4725 status=success | bucket span=10m _time
  | stats count dc(user) as unique_users values(user) as user by EventCode signature
  _time src_user SubjectDomainName TargetDomainName Logon_ID | where unique_users
  > 5 | `windows_multiple_accounts_disabled_filter`'
@@ -1,7 +1,7 @@
 author: Mauricio Velazco, Splunk
 data_source:
 - Windows Event Log Security 4776
-date: '2024-05-17'
+date: '2024-09-24'
 description: 'The following analytic detects a single source endpoint failing to authenticate
  with 30 unique invalid users using the NTLM protocol. It leverages EventCode 4776
  from Domain Controller logs, focusing on error code 0xC0000064, which indicates
@@ -24,7 +24,7 @@ references:
 - https://attack.mitre.org/techniques/T1110/003/
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
-search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064
+search: '`wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064
  | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName)
  as tried_accounts by _time, Workstation | where unique_accounts > 30 | `windows_multiple_invalid_users_failed_to_authenticate_using_ntlm_filter`'
 status: production
@@ -64,4 +64,4 @@ tests:
    sourcetype: XmlWinEventLog
  name: True Positive Test
 type: TTP
-version: 3
+version: 4
@@ -1,7 +1,7 @@
 author: Mauricio Velazco, Splunk
 data_source:
 - Windows Event Log Security 4648
-date: '2024-05-17'
+date: '2024-09-24'
 description: 'The following analytic identifies a source user failing to authenticate
  with 30 unique users using explicit credentials on a host. It leverages Windows
  Event 4648, which is generated when a process attempts an account logon by explicitly
@@ -25,7 +25,7 @@ references:
 - https://attack.mitre.org/techniques/T1110/003/
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
-search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$
+search: '`wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$
  | bucket span=5m _time | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name)
  as  tried_account by _time, Computer, Caller_User_Name | where unique_accounts >
  30 | `windows_multiple_users_fail_to_authenticate_wth_explicitcredentials_filter`'
@@ -67,4 +67,4 @@ tests:
    sourcetype: XmlWinEventLog
  name: True Positive Test
 type: TTP
-version: 3
+version: 4
@@ -1,7 +1,7 @@
 author: Mauricio Velazco, Splunk
 data_source:
 - Windows Event Log Security 4776
-date: '2024-05-26'
+date: '2024-09-24'
 description: 'The following analytic identifies a single source endpoint failing to
  authenticate with 30 unique valid users using the NTLM protocol. It leverages EventCode
  4776 from Domain Controller logs, focusing on error code 0xC000006A, which indicates
@@ -23,7 +23,7 @@ references:
 - https://attack.mitre.org/techniques/T1110/003/
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
-search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A
+search: '`wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A
  | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName)
  as tried_accounts by _time, Workstation | where unique_accounts > 30 | `windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter`'
 status: production
@@ -63,4 +63,4 @@ tests:
    sourcetype: XmlWinEventLog
  name: True Positive Test
 type: TTP
-version: 3
+version: 4
--- a/Show More
+++ b/Show More