Branch was auto-updated.

detections/endpoint/active_setup_registry_autostart.yml

@@ -13,17 +13,19 @@ description: This analytic is to detect a suspicious modification of the active
   do the modification since modification of this registry is not commonly done. check
   the legitimacy of the file and process involve in this rules to check if it is a
   valid setup installer that creating or modifying this registry.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry 
-  where Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `active_setup_registry_autostart_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
+  where Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active
+  Setup\\Installed Components*" by _time span=1h Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
+  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
+  dest user parent_process_name parent_process process_name process_path process proc_guid
+  registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name
+  parent_process process_name process_path process proc_guid registry_path registry_value_name
+  registry_value_data | `active_setup_registry_autostart_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/add_defaultuser_and_password_in_registry.yml

@@ -12,18 +12,21 @@ description: this search is to detect a suspicious registry modification to impl
   continue encrypting the whole network. This behavior is not a common practice and
   really a suspicious TTP or alert need to be consider if found within then network
   premise.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" 
-  AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_value_data Registry.registry_key_name
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
-  | `add_defaultuser_and_password_in_registry_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*"
+  AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name=
+  DefaultUserName by _time span=1h Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.process_guid Registry.registry_value_data
+  Registry.registry_key_name | `drop_dm_object_name(Registry)` |rename process_guid
+  as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `add_defaultuser_and_password_in_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -10,20 +10,21 @@ description: This analytic detects a potential suspicious modification of firewa
   rule registry allowing inbound traffic in specific port with public profile. This
   technique was identified when an adversary wants to grant remote access to a machine
   by allowing the traffic in a firewall rule.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" 
-  Registry.registry_value_data = "*|Action=Allow|*" 
-  Registry.registry_value_data = "*|Dir=In|*" 
-  Registry.registry_value_data = "*|Profile=Public|*" 
-  Registry.registry_value_data = "*|LPort=*" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
+  Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data =
+  "*|Dir=In|*" Registry.registry_value_data = "*|Profile=Public|*" Registry.registry_value_data
+  = "*|LPort=*" by _time span=1h Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
+  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
+  dest user parent_process_name parent_process process_name process_path process proc_guid
+  registry_path registry_value_name registry_value_data registry_key_name] | table
+  _time dest user parent_process_name parent_process process_name process_path process
+  proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/allow_operation_with_consent_admin.yml

@@ -11,18 +11,20 @@ description: This analytic identifies a potential privilege escalation attempt t
   Admin` to perform an operation that requires elevation without consent or credentials.
   We also found this in some attacker to gain privilege escalation to the compromise
   machine.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" 
-  Registry.registry_value_name = ConsentPromptBehaviorAdmin 
-  Registry.registry_value_data = "0x00000000" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*"
+  Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data
+  = "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
+  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
+  dest user parent_process_name parent_process process_name process_path process proc_guid
+  registry_path registry_value_name registry_value_data registry_key_name] | table
+  _time dest user parent_process_name parent_process process_name process_path process
+  proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `allow_operation_with_consent_admin_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model

detections/endpoint/disable_amsi_through_registry.yml

@@ -10,17 +10,19 @@ description: this search is to identify modification in registry to disable AMSI
   feature to evade detections. This technique was seen in several ransomware, RAT
   and even APT to impaire defenses of the compromise machine and to be able to execute
   payload with minimal alert as much as possible.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disable_amsi_through_registry_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
+  Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" by _time
+  span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_amsi_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disable_defender_antivirus_registry.yml

@@ -11,18 +11,19 @@ description: This particular behavior is typically executed when an adversaries
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
-
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data = 0x00000001 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
-  | `disable_defender_antivirus_registry_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name
+  = DisableAntiVirus Registry.registry_value_data = 0x00000001 by _time span=1h Registry.dest
+  Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_antivirus_registry_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disable_defender_blockatfirstseen_feature.yml

@@ -10,17 +10,19 @@ description: This analytic is to detect a suspicious modification of registry to
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the BlockAtFirstSeen feature where it block
   suspicious file first seen in the host.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disable_defender_blockatfirstseen_feature_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
+  = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by _time span=1h
+  Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_blockatfirstseen_feature_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disable_defender_enhanced_notification.yml

@@ -10,17 +10,19 @@ description: This analytic is to detect a suspicious modification of registry to
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the Enhanced Notification feature wher user
   or admin set to show or display alerts.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disable_defender_enhanced_notification_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name
+  = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by _time
+  span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_enhanced_notification_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data executions
   from your endpoints. If you are using Sysmon, you must have at least version 6.0.4

detections/endpoint/disable_defender_mpengine_registry.yml

@@ -11,17 +11,19 @@ description: This particular behavior is typically executed when an adversaries
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disable_defender_mpengine_registry_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*"
+  Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_mpengine_registry_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disable_defender_spynet_reporting.yml

@@ -9,17 +9,19 @@ datamodel:
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the spynet reporting for its telemetry.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disable_defender_spynet_reporting_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
+  = SpynetReporting Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest
+  Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_spynet_reporting_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disable_defender_submit_samples_consent_feature.yml

@@ -9,17 +9,19 @@ datamodel:
 description: his analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the submit samples feature for further analysis..
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disable_defender_submit_samples_consent_feature_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
+  = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by _time span=1h
+  Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_submit_samples_consent_feature_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disable_etw_through_registry.yml

@@ -10,17 +10,19 @@ description: this search is to identify modification in registry to disable ETW
   feature to evade detections. This technique was seen in several ransomware, RAT
   and even APT to impaire defenses of the compromise machine and to be able to execute
   payload with minimal alert as much as possible.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disable_etw_through_registry_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
+  Registry.registry_value_data = "0x00000000" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_etw_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disable_registry_tool.yml

@@ -11,17 +11,19 @@ description: This search identifies modification of registry to disable the rege
   knife in analyzing registry, malware such as RAT or trojan Spy disable this application
   to prevent the removal of their registry entry such as persistence, file less components
   and defense evasion.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disable_registry_tool_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_registry_tool_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disable_security_logs_using_minint_registry.yml

@@ -10,17 +10,18 @@ description: This analytic is to detect a suspicious registry modification to di
   security audit logs. This technique was shared by a researcher to disable Security
   logs of windows by adding this registry. The Windows will think it is WinPE and
   will not log any event to the Security Log
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry 
-  where Registry.registry_path="*\\Control\\MiniNt\\*"
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disable_security_logs_using_minint_registry_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
+  where Registry.registry_path="*\\Control\\MiniNt\\*" by _time span=1h Registry.dest
+  Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_security_logs_using_minint_registry_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/disable_show_hidden_files.yml

@@ -10,19 +10,21 @@ description: The following analytic is to identify a modification in the Windows
   to prevent users from seeing all the files with hidden attributes. This event or
   techniques are known on some worm and trojan spy malware that will drop hidden files
   on the infected machine.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" 
-  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") 
-  OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000") 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disable_show_hidden_files_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
+  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt"
+  Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden"
+  Registry.registry_value_data = "0x00000000") by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_show_hidden_files_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disable_uac_remote_restriction.yml

@@ -11,17 +11,19 @@ description: This analytic is to detect a suspicious modification of registry to
   attacker may modify this registry value to bypassed UAC feature of windows host.
   This is a good indicator that some tries to bypassed UAC to suspicious process or
   gain privilege escalation.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
-  where Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disable_uac_remote_restriction_filter`'
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Policies\\System*"
+  Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001"
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_uac_remote_restriction_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/disable_windows_app_hotkeys.yml

@@ -11,16 +11,20 @@ description: This analytic detects a suspicious registry modification to disable
   used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`.
   This technique is used to impair the analyst in analyzing and removing the attacker
   implant in compromised systems.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry 
-  where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
+  where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution
+  Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name
+  = "Debugger" by _time span=1h Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
+  | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
+  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
+  dest user parent_process_name parent_process process_name process_path process proc_guid
+  registry_path registry_value_name registry_value_data registry_key_name] | table
+  _time dest user parent_process_name parent_process process_name process_path process
+  proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `disable_windows_app_hotkeys_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model

detections/endpoint/disable_windows_behavior_monitoring.yml

@@ -9,23 +9,26 @@ datamodel:
 description: This search is to identifies a modification in registry to disable the
   windows denfender real time behavior monitoring. This event or technique is commonly
   seen in RAT, bot, or Trojan to disable AV to evade detections.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" 
-  OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection"
-  OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" 
-  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" 
-  OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" 
-  OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" 
-  OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data  
-  | `disable_windows_behavior_monitoring_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
+  Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows
+  Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path=
+  "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable"
+  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time
+  Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time
+  Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time
+  Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning"
+  AND Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_windows_behavior_monitoring_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disable_windows_smartscreen_protection.yml

@@ -11,17 +11,18 @@ description: The following search identifies a modification of registry to disab
   early warning system against website that might engage in phishing attack or malware
   distribution. This modification are seen in RAT malware to cover their tracks upon
   downloading other of its component or other payload.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled"  Registry.registry_value_data= "Off" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
-  | `disable_windows_smartscreen_protection_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled"  Registry.registry_value_data=
+  "Off" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disable_windows_smartscreen_protection_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disabling_cmd_application.yml

@@ -10,17 +10,20 @@ description: this search is to identify modification in registry to disable cmd
   application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging
   or deleting there samples through cmd application which is one of the tool of analyst
   to traverse on directory and files.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
-  | `disabling_cmd_application_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD"
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
+  as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `disabling_cmd_application_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disabling_controlpanel.yml

@@ -9,17 +9,20 @@ datamodel:
 description: this search is to identify registry modification to disable control panel
   window. This technique is commonly seen in malware to prevent their artifacts ,
   persistence removed on the infected machine.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
-  | `disabling_controlpanel_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
+  as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `disabling_controlpanel_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disabling_defender_services.yml

@@ -11,18 +11,20 @@ description: This particular behavior is typically executed when an adversaries
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*"))  
-  AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `disabling_defender_services_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path
+  IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*"))
+  AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `disabling_defender_services_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disabling_folderoptions_windows_feature.yml

@@ -11,17 +11,20 @@ description: This search is to identify registry modification to disable folder
   used by malware in combination if disabling show hidden files feature to hide their
   files and also to hide the file extension to lure the user base on file icons or
   fake file extensions.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
-  | `disabling_folderoptions_windows_feature_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions"
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
+  as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `disabling_folderoptions_windows_feature_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disabling_norun_windows_app.yml

@@ -11,17 +11,20 @@ description: This search is to identify modification of registry to disable run
   OS user to run known application and also to execute some reg or batch script. This
   technique is used malware to make cleaning of its infection more harder by preventing
   known application run easily through run shortcut.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
-  | `disabling_norun_windows_app_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun"
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
+  as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `disabling_norun_windows_app_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disabling_systemrestore_in_registry.yml

@@ -10,18 +10,21 @@ description: The following search identifies the modification of registry relate
   in disabling the system restore of a machine. This event or behavior are seen in
   some RAT malware to make the restore of the infected machine  difficult and keep
   their infection on the box.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" 
-  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
-  | `disabling_systemrestore_in_registry_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR"
+  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig"
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
+  as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `disabling_systemrestore_in_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disabling_task_manager.yml

@@ -10,17 +10,20 @@ description: This search is to identifies modification of registry to disable th
   task manager of windows operating system. this event or technique are commonly seen
   in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate
   their process.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
-  | `disabling_task_manager_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
+  as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `disabling_task_manager_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/enable_rdp_in_other_port_number.yml

@@ -10,18 +10,20 @@ description: This search is to detect a modification to registry to enable rdp t
   a machine with different port number. This technique was seen in some atttacker
   tries to do lateral movement and remote access to a compromised machine to gain
   control of it.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
-  where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" 
-  Registry.registry_value_name = "PortNumber" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
-  | `enable_rdp_in_other_port_number_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal
+  Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber" by _time
+  span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `enable_rdp_in_other_port_number_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/enable_wdigest_uselogoncredential_registry.yml

@@ -11,17 +11,20 @@ description: This analytic is to detect a suspicious registry modification to en
   and also by mimikatz to be able to dumpe the a plain text credential to the compromised
   or target host. This TTP is really a good indicator that someone wants to dump the
   crendential of the host so it must be a good pivot for credential dumping techniques.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
-  where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*"
-  Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*"
+  Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data
+  = 0x00000001 by _time span=1h Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
+  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
+  dest user parent_process_name parent_process process_name process_path process proc_guid
+  registry_path registry_value_name registry_value_data registry_key_name] | table
+  _time dest user parent_process_name parent_process process_name process_path process
+  proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `enable_wdigest_uselogoncredential_registry_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model

detections/endpoint/etw_registry_disabled.yml

@@ -9,16 +9,20 @@ datamodel:
 description: This analytic is to detect a registry modification to disable ETW feature
   of windows. This technique is to evade EDR appliance to evade detections and hide
   its execution from audit logs.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
-  where Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*"
+  Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.process_guid Registry.registry_key_name Registry.registry_value_data |
+  `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
+  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
+  dest user parent_process_name parent_process process_name process_path process proc_guid
+  registry_path registry_value_name registry_value_data registry_key_name] | table
+  _time dest user parent_process_name parent_process process_name process_path process
+  proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `etw_registry_disabled_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model

detections/endpoint/eventvwr_uac_bypass.yml

@@ -12,17 +12,20 @@ description: The following search identifies Eventvwr bypass by identifying the
   upon eventvwr.msc loading. Upon triage, review the parallel processes that have
   executed. Identify any additional registry modifications on the endpoint that may
   look suspicious. Remediate as necessary.
-search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time)
-  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
-  where  Registry.registry_path="*mscfile\\shell\\open\\command\\*"  
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
+search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
+  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
+  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where  Registry.registry_path="*mscfile\\shell\\open\\command\\*"
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.process_guid Registry.registry_key_name Registry.registry_value_data |
+  `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
+  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
+  dest user parent_process_name parent_process process_name process_path process proc_guid
+  registry_path registry_value_name registry_value_data registry_key_name] | table
+  _time dest user parent_process_name parent_process process_name process_path process
+  proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `eventvwr_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/hide_user_account_from_sign_in_screen.yml

@@ -11,17 +11,20 @@ description: This analytic identifies a suspicious registry modification to hide
   where the adversary will create a hidden user account with Admin privileges in login
   screen to avoid noticing by the user that they already compromise and to persist
   on that said machine.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
-  where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" 
-  AND Registry.registry_value_data = "0x00000000" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows
+  NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data
+  = "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
+  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
+  dest user parent_process_name parent_process process_name process_path process proc_guid
+  registry_path registry_value_name registry_value_data registry_key_name] | table
+  _time dest user parent_process_name parent_process process_name process_path process
+  proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `hide_user_account_from_sign_in_screen_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model

detections/endpoint/potentially_malicious_code_on_commandline.yml

@@ -7,45 +7,60 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: The following analytic uses a pretrained machine learning text classifier
-  to detect potentially malicious commandlines.  The model identifies unusual
-  combinations of keywords found in samples of commandlines where adversaries executed
-  powershell code, primarily for C2 communication.  For example, adversaries will leverage
-  IO capabilities such as "streamreader" and "webclient", threading capabilties such as
-  "mutex" locks, programmatic constructs like "function" and "catch", and cryptographic
+  to detect potentially malicious commandlines.  The model identifies unusual combinations
+  of keywords found in samples of commandlines where adversaries executed powershell
+  code, primarily for C2 communication.  For example, adversaries will leverage IO
+  capabilities such as "streamreader" and "webclient", threading capabilties such
+  as "mutex" locks, programmatic constructs like "function" and "catch", and cryptographic
   operations like "computehash".  Although observing one of these keywords in a commandline
   script is possible, combinations of keywords observed in attack data are not typically
-  found in normal usage of the commandline.  The model will output a score where all values
-  above zero are suspicious, anything greater than one particularly so.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
-  max(_time) as lastTime from datamodel="Endpoint.Processes" by
-  Processes.parent_process_name Processes.process_name Processes.process
-  Processes.user Processes.dest  | `drop_dm_object_name(Processes)`  | where
-  len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score` |
-  apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'',
-  process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits) orig_process |
-  where score > 0.5 | `security_content_ctime(firstTime)` |
-  `security_content_ctime(lastTime)` | `potentially_malicious_code_on_commandline_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting logs
-  with the process name, parent process, and command-line executions from your endpoints.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.  You
-  will also need to install the Machine Learning Toolkit version 5.3 or above to apply
-  the pretrained model.
-known_false_positives: This model is an anomaly detector that identifies usage of APIs
-  and scripting constructs that are correllated with malicious activity.  These APIs and
-  scripting constructs are part of the programming langauge and advanced scripts may
-  generate false positives.
+  found in normal usage of the commandline.  The model will output a score where all
+  values above zero are suspicious, anything greater than one particularly so.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel="Endpoint.Processes" by Processes.parent_process_name
+  Processes.process_name Processes.process Processes.user Processes.dest  | `drop_dm_object_name(Processes)`  |
+  where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score`
+  | apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'',
+  process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits)
+  orig_process | where score > 0.5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `potentially_malicious_code_on_commandline_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.  You will also need to install the Machine Learning Toolkit version 5.3
+  or above to apply the pretrained model.
+known_false_positives: This model is an anomaly detector that identifies usage of
+  APIs and scripting constructs that are correllated with malicious activity.  These
+  APIs and scripting constructs are part of the programming langauge and advanced
+  scripts may generate false positives.
 references:
-  - https://attack.mitre.org/techniques/T1059/003/
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
+- https://attack.mitre.org/techniques/T1059/003/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
 tags:
   analytic_story:
   - Suspicious Command-Line Executions
+  confidence: 20
+  context:
+  - source:endpoint
+  - stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/malicious_cmd_line_samples/windows-sysmon.log
+  impact: 60
   kill_chain_phases:
   - Exploitation
+  message: Unusual command-line execution with hallmarks of malicious activity run
+    by $user$ found on $dest$ with commandline $process$
   mitre_attack_id:
   - T1059.003
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -58,20 +73,5 @@ tags:
   - Processes.parent_process
   - Processes.user
   - Processes.dest
-  security_domain: endpoint
-  impact: 60
-  confidence: 20
   risk_score: 12
-  context:
-    - source:endpoint
-    - stage:Execution
-  message: Unusual command-line execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$
-  observable:
-    - name: dest
-      type: Hostname
-      role:
-        - Victim
-    - name: user
-      type: User
-      role:
-        - Victim
+  security_domain: endpoint

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -8,29 +8,32 @@ datamodel:
 - Endpoint
 description: The search looks for modifications to registry keys that can be used
   to launch an application or service at system startup.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run*
-  OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell*
-  OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit*
-  OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run*
-  OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*
-  OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution
-  Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa"
-  AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig"
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
+  where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls*
+  OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify*
+  OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet*
+  OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices*
+  OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows
+  NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger)
+  OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security
+  Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig"
   AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows
   NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows"
   AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion"
   AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session
   Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run"
-  AND Registry.registry_key_name="auto_update"))
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
-  | `registry_keys_used_for_persistence_filter`'
+  AND Registry.registry_key_name="auto_update")) by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `registry_keys_used_for_persistence_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/registry_keys_used_for_privilege_escalation.yml

@@ -9,17 +9,20 @@ description: This search looks for modifications to registry keys that can be us
   to elevate privileges. The registry keys under "Image File Execution Options" are
   used to intercept calls to an executable and can be used to attach malicious binaries
   to benign system binaries.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry 
-  where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") 
-  AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger) 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
+  where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File
+  Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger)
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid Registry.registry_key_name |
+  `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
+  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
+  dest user parent_process_name parent_process process_name process_path process proc_guid
+  registry_path registry_value_name registry_value_data registry_key_name] | table
+  _time dest user parent_process_name parent_process process_name process_path process
+  proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `registry_keys_used_for_privilege_escalation_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model

detections/endpoint/remcos_client_registry_install_entry.yml

@@ -9,16 +9,17 @@ datamodel:
 description: This search detects registry key license at host where Remcos RAT agent
   is installed.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
-  where (Registry.registry_key_name=*\\Software\\Remcos*) 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  |`remcos_client_registry_install_entry_filter`'
+  where (Registry.registry_key_name=*\\Software\\Remcos*) by _time span=1h Registry.dest
+  Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data |`remcos_client_registry_install_entry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/revil_registry_entry.yml

@@ -11,17 +11,19 @@ description: This analytic identifies suspicious modification in registry entry
   implant, malware and ransomware like REVIL where it keep some information like the
   random generated file extension it uses for all the encrypted files and ransomware
   notes file name in the compromised host.
-search: '| tstats `security_content_summariesonly` count  FROM datamodel=Endpoint.Registry 
-  where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `revil_registry_entry_filter`'
+search: '| tstats `security_content_summariesonly` count  FROM datamodel=Endpoint.Registry
+  where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*"
+  OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by _time
+  span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `revil_registry_entry_filter`'
 how_to_implement: to successfully implement this search, you need to be ingesting
   logs with the Image, TargetObject registry key, registry Details from your endpoints.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml

@@ -14,12 +14,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-  | where cmd_line IS NOT NULL AND like(cmd_line, "%/w:%") AND process_name="cipher.exe" 
-  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
-  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
-  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
-  "parent_process_name", parent_process_name, "process_path", process_path]) 
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND like(cmd_line, "%/w:%") AND process_name="cipher.exe" |
+  eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
   | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -32,39 +32,27 @@ tags:
   analytic_story:
   - Ransomware
   - Information Sabotage
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1070.004
-  - T1070
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
-  confidence: 100 
-  # (impact * confidence)/100
-  risk_score: 90
+  cis20:
+  - CIS 14
+  - CIS 16
+  confidence: 100
   context:
   - Source:Endpoint
   - Stage:Impact
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors
     of a specific disk.
+  mitre_attack_id:
+  - T1070.004
+  - T1070
+  nist:
+  - PR.AC
+  - PR.IP
   observable:
   - name: user
     type: User
@@ -82,10 +70,20 @@ tags:
     type: Process
     role:
     - Child Process
-  nist:
-  - PR.AC
-  - PR.IP
-  cis20:
-  - CIS 14
-  - CIS 16
-  
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/ssa___fsutil_zeroing_file.yml

@@ -63,9 +63,6 @@ tags:
     deletion.
   mitre_attack_id:
   - T1070
-  nist:
-  - PR.AC
-  - PR.IP
   nist: []
   observable:
   - name: dest_user_id

detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml

@@ -15,12 +15,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-  | where cmd_line IS NOT NULL AND like(cmd_line, "%+h%") AND process_name="attrib.exe" 
-  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
-  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
-  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
-  "parent_process_name", parent_process_name, "process_path", process_path]) 
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND match_regex(cmd_line, /\+h/)=true AND process_name="attrib.exe" |
+  eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
   | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -30,33 +30,32 @@ how_to_implement: You must be ingesting data that records process activity from
 known_false_positives: 'Some applications and users may legitimately use attrib.exe
   to interact with the files. '
 references:
--  https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Windows Persistence Techniques
   - Information Sabotage
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1222.001
-  - T1222
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  security_domain: endpoint
-  impact: 80
-  confidence: 90 
-  # (impact * confidence)/100
-  risk_score: 72
+  cis20:
+  - CIS 14
+  - CIS 16
+  confidence: 90
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
   - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
   message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
+  mitre_attack_id:
+  - T1222.001
+  - T1222
+  nist:
+  - PR.AC
+  - PR.IP
   observable:
   - name: user
     type: User
@@ -71,10 +70,10 @@ tags:
     role:
     - Attacker
     - Parent Process
-  nist:
-  - PR.AC
-  - PR.IP
-  cis20:
-  - CIS 14
-  - CIS 16
-  
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  risk_score: 72
+  security_domain: endpoint
+

detections/endpoint/start_up_during_safe_mode_boot.yml

@@ -9,17 +9,18 @@ datamodel:
 description: This search is to detect a modification or registry add to the safeboot
   registry as an autostart mechanism. This technique was seen in some ransomware to
   automatically execute its code upon a safe mode boot.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry 
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*"
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
-  | `start_up_during_safe_mode_boot_filter`'
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `start_up_during_safe_mode_boot_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/time_provider_persistence_registry.yml

@@ -11,17 +11,19 @@ description: This analytic is to detect a suspicious modification of time provid
   persist on the compromised host and autostart as soon as the machine boot up. This
   TTP can be a good indicator of suspicious behavior since this registry is not commonly
   modified by normal user or even an admin.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
-  where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
-  | `drop_dm_object_name(Registry)` 
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
-  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
-  | `time_provider_persistence_registry_filter`'
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
+  ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by _time span=1h Registry.dest
+  Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `time_provider_persistence_registry_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/windows_possible_credential_dumping.yml

@@ -24,18 +24,18 @@ description: 'The following analytic is an enhanced version of two previous anal
   For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory,
   used to execute this module which is related to lsass dumping.'
 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000",
-  "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a",
-  "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage,
-  GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer
-  as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `windows_possible_credential_dumping_filter`'
+  "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438",
+  "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") | stats
+  count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess,
+  SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest |
+  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
-known_false_positives: False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based
-  on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught.
+known_false_positives: False positives will occur based on GrantedAccess 0x1010 and
+  0x1400, filter based on source image as needed or remove them. Concern is Cobalt
+  Strike usage of Mimikatz will generate 0x1010 initially, but later be caught.
 references:
 - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
 - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump

detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml

@@ -6,43 +6,56 @@ author: Lou Stella, Splunk
 type: Anomaly
 datamodel:
 - Endpoint_Processes
-description: This is an anomaly generating detection looking for multiple interactive logins within a specific time period. An insider threat may attempt to steal colleagues credentials in low tech, undetectable methods, in order to gain access to additional information or to hide their own behavior. This should capture their attempted use of those credentials on a workstation. 
-search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "dest_user_original_artifact"), "string", null), signature_id=ucast(map_get(input_event, "EventCode"), "string", null) | where signature_id="4624" | where auth_type="2" OR auth_type="11" | where NOT (src_user="SYSTEM") AND NOT (src_user="ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by device, span(timestamp, 600s, 300s) | where user_counter>=2  | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();'
-how_to_implement: To successfully implement this detection, you need to be ingesting logon events from workstations.
+description: This is an anomaly generating detection looking for multiple interactive
+  logins within a specific time period. An insider threat may attempt to steal colleagues
+  credentials in low tech, undetectable methods, in order to gain access to additional
+  information or to hide their own behavior. This should capture their attempted use
+  of those credentials on a workstation.
+search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
+  "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"),
+  "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+  null)), src_user=ucast(map_get(input_event, "dest_user_original_artifact"), "string",
+  null), signature_id=ucast(map_get(input_event, "EventCode"), "string", null) | where
+  signature_id="4624" | where auth_type="2" OR auth_type="11" | where NOT (src_user="SYSTEM")
+  AND NOT (src_user="ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by
+  device, span(timestamp, 600s, 300s) | where user_counter>=2  | rename window_end
+  AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device),
+  body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this detection, you need to be ingesting
+  logon events from workstations.
 known_false_positives: Shared workstations can cause false positives
 references:
--  https://attack.mitre.org/techniques/T1078/002/
+- https://attack.mitre.org/techniques/T1078/002/
 tags:
   analytic_story:
   - Insider Threat
-  kill_chain_phases:
-  - Privilege Escalation
-  - Lateral Movement
-  mitre_attack_id:
-  - T1078.002
   cis20:
   - CIS 14
-  nist:
-  - PR.AC
-  - DE.AE
-  product:
-  - Splunk Behavioral Analytics
-  dataset:
-    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_login/windows-security.log
-  required_fields:
-  - _time
-  security_domain: access
-  impact: 20
   confidence: 30
-  risk_score: 6
   context:
   - Source:Endpoint
   - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_login/windows-security.log
+  impact: 20
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
   message: Multiple interactive logins detected on $device$
-  risk_severity: low
+  mitre_attack_id:
+  - T1078.002
+  nist:
+  - PR.AC
+  - DE.AE
   observable:
   - name: device
     type: Hostname
     role:
     - Victim
-  
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  risk_score: 6
+  risk_severity: low
+  security_domain: access

detections/experimental/ssa___disable_defender_antivirus_registry.yml

@@ -11,23 +11,18 @@ description: This particular behavior is typically executed when an adversaries
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
-search: '| from read_ssa_enriched_events() 
-| eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
-    "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string",
-    null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"), "string",
-    null)), registry_value_data=ucast(map_get(input_event, "registry_value_data"), "string", null),
-    process_guid=ucast(map_get(input_event, "process_guid"), "string",
-    null),
-    event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where like(registry_path, "%\\Policies\\Microsoft\\Windows Defender%")
-    AND registry_key_name="DisableAntiVirus" AND registry_value_data="(0x00000001)"
-| eval start_time=timestamp,
-    end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
-    "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
-    body=create_map( 
-    [ "event_id", event_id, "registry_path", registry_path, "registry_key_name",
-        registry_key_name, "process_guid", process_guid,"registry_value_data",registry_value_data]) 
-| into write_ssa_detected_events();'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
+  "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"),
+  "string", null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"),
+  "string", null)), registry_value_data=ucast(map_get(input_event, "registry_value_data"),
+  "string", null), process_guid=ucast(map_get(input_event, "process_guid"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  like(registry_path, "%\\Policies\\Microsoft\\Windows Defender%") AND registry_key_name="DisableAntiVirus"
+  AND registry_value_data="(0x00000001)" | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map( [ "event_id", event_id, "registry_path",
+  registry_path, "registry_key_name", registry_key_name, "process_guid", process_guid,"registry_value_data",registry_value_data])
+  | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.34.0"
+      "version": "3.34.1"
     }, 
     "author": [
       {

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-01-26T22:49:42 UTC
+# On Date: 2022-01-31T19:58:16 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -625,7 +625,7 @@ references = ["https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injectio
 maintainers = [{"company": "no", "email": "-", "name": "Jose Hernandez"}]
 spec_version = 3
 searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Curl Download and Bash Execution - Rule", "ESCU - Detect Outbound LDAP Traffic - Rule", "ESCU - Hunting for Log4Shell - Rule", "ESCU - Java Class File download by Java User Agent - Rule", "ESCU - Linux Java Spawning Shell - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule", "ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule", "ESCU - Outbound Network Connection from Java Using Default Ports - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Wget Download and Bash Execution - Rule", "ESCU - Windows Java Spawning Shells - Rule"]
-description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Respond', 'Log4j Splunk Investigation', 'Log4j Investigate' 
+description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Splunk Investigation', 'Log4j Respond' 
 narrative = In late November 2021, Chen Zhaojun of Alibaba identified a remote code execution vulnerability. Previous work was seen in a 2016 Blackhat talk by Alvaro Munoz and Oleksandr Mirosh called ["A Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land"](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf). Reported under the CVE ID : CVE-2021-44228, released to the public on December 10, 2021. The vulnerability is exploited through improper deserialization of user input passed into the framework. It permits remote code execution and it can allow an attacker to leak sensitive data, such as environment variables, or execute malicious software on the target system.
 
 [analytic_story://Malicious PowerShell]
@@ -1072,7 +1072,7 @@ version = 2
 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Potentially malicious code on commandline - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
 narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation.
 
@@ -6876,6 +6876,16 @@ annotations = {"kill_chain_phases": ["Lateral Movement", "Malicious PowerShell"]
 known_false_positives = Legitimate applications may spawn PowerShell as a child process of the the identified processes. Filter as needed.
 providing_technologies = []
 
+[savedsearch://ESCU - Potentially malicious code on commandline - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic uses a pretrained machine learning text classifier to detect potentially malicious commandlines.  The model identifies unusual combinations of keywords found in samples of commandlines where adversaries executed powershell code, primarily for C2 communication.  For example, adversaries will leverage IO capabilities such as "streamreader" and "webclient", threading capabilties such as "mutex" locks, programmatic constructs like "function" and "catch", and cryptographic operations like "computehash".  Although observing one of these keywords in a commandline script is possible, combinations of keywords observed in attack data are not typically found in normal usage of the commandline.  The model will output a score where all values above zero are suspicious, anything greater than one particularly so.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.  You will also need to install the Machine Learning Toolkit version 5.3 or above to apply the pretrained model.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"]}
+known_false_positives = This model is an anomaly detector that identifies usage of APIs and scripting constructs that are correllated with malicious activity.  These APIs and scripting constructs are part of the programming langauge and advanced scripts may generate false positives.
+providing_technologies = []
+
 [savedsearch://ESCU - PowerShell - Connect To Internet With Hidden Window - Rule]
 type = detection
 asset_type = Endpoint
@@ -8699,7 +8709,7 @@ providing_technologies = []
 type = detection
 asset_type = 
 confidence = medium
-explanation = This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
+explanation = This analytic is to detect a suspicious modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.003", "T1547"]}
 known_false_positives = unknown
@@ -9366,7 +9376,7 @@ dbgcore.dll or dbghelp.dll  are two core Windows debug DLLs that have minidump f
 The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory, used to execute this module which is related to lsass dumping.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
 annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"]}
-known_false_positives = False positives will occur based on GrantedAccess, filter based on source image as needed.
+known_false_positives = False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught.
 providing_technologies = []
 
 [savedsearch://ESCU - Windows Raccine Scheduled Task Deletion - Rule]

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 4621
+build = 4768
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.34.0
+version = 3.34.1
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-01-26T22:49:42 UTC
+# On Date: 2022-01-31T19:58:16 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 3.34.0
+version = 3.34.1

dist/escu/default/es_investigations.conf

@@ -337,7 +337,7 @@ panels = ["panel://workbench_panel_get_notable_history___response_task"]
 
 [panel_group://workbench_panel_group_log4shell_cve_2021_44228]
 label = Log4Shell CVE-2021-44228
-description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Respond', 'Log4j Splunk Investigation', 'Log4j Investigate' 
+description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Splunk Investigation', 'Log4j Respond' 
 disabled = 0
 
 panels = ["panel://workbench_panel_get_notable_history___response_task"]

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-01-26T22:49:42 UTC
+# On Date: 2022-01-31T19:58:16 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -210,6 +210,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = eventtype="osquery-process"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[potentially_malicious_code_on_cmdline_tokenize_score]
+definition = eval orig_process=process, process=replace(lower(process), "`", "") | makemv tokenizer="([\w\d\-]+)" process | eval unusual_cmdline_feature_for=if(match(process, "^for$"), mvcount(mvfilter(match(process, "^for$"))), 0), unusual_cmdline_feature_netsh=if(match(process, "^netsh$"), mvcount(mvfilter(match(process, "^netsh$"))), 0), unusual_cmdline_feature_readbytes=if(match(process, "^readbytes$"), mvcount(mvfilter(match(process, "^readbytes$"))), 0), unusual_cmdline_feature_set=if(match(process, "^set$"), mvcount(mvfilter(match(process, "^set$"))), 0), unusual_cmdline_feature_unrestricted=if(match(process, "^unrestricted$"), mvcount(mvfilter(match(process, "^unrestricted$"))), 0), unusual_cmdline_feature_winstations=if(match(process, "^winstations$"), mvcount(mvfilter(match(process, "^winstations$"))), 0), unusual_cmdline_feature_-value=if(match(process, "^-value$"), mvcount(mvfilter(match(process, "^-value$"))), 0), unusual_cmdline_feature_compression=if(match(process, "^compression$"), mvcount(mvfilter(match(process, "^compression$"))), 0), unusual_cmdline_feature_server=if(match(process, "^server$"), mvcount(mvfilter(match(process, "^server$"))), 0), unusual_cmdline_feature_set-mppreference=if(match(process, "^set-mppreference$"), mvcount(mvfilter(match(process, "^set-mppreference$"))), 0), unusual_cmdline_feature_terminal=if(match(process, "^terminal$"), mvcount(mvfilter(match(process, "^terminal$"))), 0), unusual_cmdline_feature_-name=if(match(process, "^-name$"), mvcount(mvfilter(match(process, "^-name$"))), 0), unusual_cmdline_feature_catch=if(match(process, "^catch$"), mvcount(mvfilter(match(process, "^catch$"))), 0), unusual_cmdline_feature_get-wmiobject=if(match(process, "^get-wmiobject$"), mvcount(mvfilter(match(process, "^get-wmiobject$"))), 0), unusual_cmdline_feature_hklm=if(match(process, "^hklm$"), mvcount(mvfilter(match(process, "^hklm$"))), 0), unusual_cmdline_feature_streamreader=if(match(process, "^streamreader$"), mvcount(mvfilter(match(process, "^streamreader$"))), 0), unusual_cmdline_feature_system32=if(match(process, "^system32$"), mvcount(mvfilter(match(process, "^system32$"))), 0), unusual_cmdline_feature_username=if(match(process, "^username$"), mvcount(mvfilter(match(process, "^username$"))), 0), unusual_cmdline_feature_webrequest=if(match(process, "^webrequest$"), mvcount(mvfilter(match(process, "^webrequest$"))), 0), unusual_cmdline_feature_count=if(match(process, "^count$"), mvcount(mvfilter(match(process, "^count$"))), 0), unusual_cmdline_feature_webclient=if(match(process, "^webclient$"), mvcount(mvfilter(match(process, "^webclient$"))), 0), unusual_cmdline_feature_writeallbytes=if(match(process, "^writeallbytes$"), mvcount(mvfilter(match(process, "^writeallbytes$"))), 0), unusual_cmdline_feature_convert=if(match(process, "^convert$"), mvcount(mvfilter(match(process, "^convert$"))), 0), unusual_cmdline_feature_create=if(match(process, "^create$"), mvcount(mvfilter(match(process, "^create$"))), 0), unusual_cmdline_feature_function=if(match(process, "^function$"), mvcount(mvfilter(match(process, "^function$"))), 0), unusual_cmdline_feature_net=if(match(process, "^net$"), mvcount(mvfilter(match(process, "^net$"))), 0), unusual_cmdline_feature_com=if(match(process, "^com$"), mvcount(mvfilter(match(process, "^com$"))), 0), unusual_cmdline_feature_http=if(match(process, "^http$"), mvcount(mvfilter(match(process, "^http$"))), 0), unusual_cmdline_feature_io=if(match(process, "^io$"), mvcount(mvfilter(match(process, "^io$"))), 0), unusual_cmdline_feature_system=if(match(process, "^system$"), mvcount(mvfilter(match(process, "^system$"))), 0), unusual_cmdline_feature_new-object=if(match(process, "^new-object$"), mvcount(mvfilter(match(process, "^new-object$"))), 0), unusual_cmdline_feature_if=if(match(process, "^if$"), mvcount(mvfilter(match(process, "^if$"))), 0), unusual_cmdline_feature_threading=if(match(process, "^threading$"), mvcount(mvfilter(match(process, "^threading$"))), 0), unusual_cmdline_feature_mutex=if(match(process, "^mutex$"), mvcount(mvfilter(match(process, "^mutex$"))), 0), unusual_cmdline_feature_cryptography=if(match(process, "^cryptography$"), mvcount(mvfilter(match(process, "^cryptography$"))), 0), unusual_cmdline_feature_computehash=if(match(process, "^computehash$"), mvcount(mvfilter(match(process, "^computehash$"))), 0)
+description = Performs the tokenization and application of the malicious commandline classifier
+
 [powershell]
 definition = (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational")
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -2951,6 +2955,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[potentially_malicious_code_on_commandline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [powershell___connect_to_internet_with_hidden_window_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

dist/escu/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-01-26T22:49:42 UTC
+# On Date: 2022-01-31T19:58:15 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1611,8 +1611,8 @@ action.escu.data_models = []
 action.escu.eli5 = This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = Active setup installer may add or modify this registry.
-action.escu.creation_date = 2021-09-28
-action.escu.modification_date = 2021-09-28
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Active Setup Registry Autostart - Rule
 action.escu.search_type = detection
@@ -1645,7 +1645,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `active_setup_registry_autostart_filter`
 
 [ESCU - Add DefaultUser And Password In Registry - Rule]
 action.escu = 0
@@ -1656,8 +1656,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after  triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-09-06
-action.escu.modification_date = 2021-09-06
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Add DefaultUser And Password In Registry - Rule
 action.escu.search_type = detection
@@ -1676,7 +1676,7 @@ action.correlationsearch.label = ESCU - Add DefaultUser And Password In Registry
 action.correlationsearch.annotations = {"analytic_story": ["BlackMatter Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002", "T1552"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after  triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise.
 action.notable.param.rule_title = Add DefaultUser And Password In Registry
 action.notable.param.security_domain = endpoint
@@ -1690,7 +1690,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_value_data Registry.registry_key_name | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `add_defaultuser_and_password_in_registry_filter`
 
 [ESCU - Add or Set Windows Defender Exclusion - Rule]
 action.escu = 0
@@ -1831,8 +1831,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.
-action.escu.creation_date = 2021-05-26
-action.escu.modification_date = 2021-05-26
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule
 action.escu.search_type = detection
@@ -1865,7 +1865,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name = "*|Dir=In|*" Registry.registry_value_name = "*|Profile=Public|*" Registry.registry_value_name = "*|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*" Registry.registry_value_data = "*|Profile=Public|*" Registry.registry_value_data = "*|LPort=*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `allow_inbound_traffic_by_firewall_rule_registry_filter`
 
 [ESCU - Allow Inbound Traffic In Firewall Rule - Rule]
 action.escu = 0
@@ -1961,8 +1961,8 @@ action.escu.data_models = []
 action.escu.eli5 = This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-06-10
-action.escu.modification_date = 2021-06-10
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Allow Operation with Consent Admin - Rule
 action.escu.search_type = detection
@@ -1981,7 +1981,7 @@ action.correlationsearch.label = ESCU - Allow Operation with Consent Admin - Rul
 action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine.
 action.notable.param.rule_title = Allow Operation with Consent Admin
 action.notable.param.security_domain = endpoint
@@ -1995,7 +1995,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `allow_operation_with_consent_admin_filter`
 
 [ESCU - Amazon EKS Kubernetes Pod scan detection - Rule]
 action.escu = 0
@@ -6227,7 +6227,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `google_gcp_pubsub_message` | multikv | rename sc_status_ as status | rename cs_object_ as bucket_name | rename c_ip_ as remote_ip | rename cs_uri_ as request_uri | rename cs_method_ as operation | search status="\"200\"" | stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip operation request_uri | table firstTime, lastTime, bucket_name, remote_ip, operation, request_uri | inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip.csv | stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip operation request_uri | outputlookup previously_seen_gcp_storage_access_from_remote_ip.csv | eval newIP=if(firstTime >= relative_time(now(),"-70m@m"), 1, 0) | where newIP=1 | eval first_time=strftime(firstTime,"%m/%d/%y %H:%M:%S") | eval last_time=strftime(lastTime,"%m/%d/%y %H:%M:%S") | table  first_time last_time bucket_name remote_ip operation request_uri | `detect_gcp_storage_access_from_a_new_ip_filter`
+search = `google_gcp_pubsub_message` | multikv | rename sc_status_ as status | rename cs_object_ as bucket_name | rename c_ip_ as remote_ip | rename cs_uri_ as request_uri | rename cs_method_ as operation | search status="\"200\"" | stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip operation request_uri | table firstTime, lastTime, bucket_name, remote_ip, operation, request_uri | inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip | stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip operation request_uri | outputlookup previously_seen_gcp_storage_access_from_remote_ip | eval newIP=if(firstTime >= relative_time(now(),"-70m@m"), 1, 0) | where newIP=1 | eval first_time=strftime(firstTime,"%m/%d/%y %H:%M:%S") | eval last_time=strftime(lastTime,"%m/%d/%y %H:%M:%S") | table  first_time last_time bucket_name remote_ip operation request_uri | `detect_gcp_storage_access_from_a_new_ip_filter`
 
 [ESCU - Detect HTML Help Renamed - Rule]
 action.escu = 0
@@ -9461,8 +9461,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = network operator may disable this feature of windows but not so common.
-action.escu.creation_date = 2021-06-22
-action.escu.modification_date = 2021-06-22
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable AMSI Through Registry - Rule
 action.escu.search_type = detection
@@ -9477,7 +9477,7 @@ action.correlationsearch.label = ESCU - Disable AMSI Through Registry - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible.
 action.notable.param.rule_title = Disable AMSI Through Registry
 action.notable.param.security_domain = endpoint
@@ -9491,7 +9491,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_amsi_through_registry_filter`
 
 [ESCU - Disable Defender AntiVirus Registry - Rule]
 action.escu = 0
@@ -9502,8 +9502,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
-action.escu.creation_date = 2021-10-18
-action.escu.modification_date = 2021-10-18
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender AntiVirus Registry - Rule
 action.escu.search_type = detection
@@ -9536,7 +9536,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_antivirus_registry_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data = 0x00000001 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_antivirus_registry_filter`
 
 [ESCU - Disable Defender BlockAtFirstSeen Feature - Rule]
 action.escu = 0
@@ -9547,8 +9547,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
-action.escu.creation_date = 2021-10-18
-action.escu.modification_date = 2021-10-18
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender BlockAtFirstSeen Feature - Rule
 action.escu.search_type = detection
@@ -9581,7 +9581,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_blockatfirstseen_feature_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_blockatfirstseen_feature_filter`
 
 [ESCU - Disable Defender Enhanced Notification - Rule]
 action.escu = 0
@@ -9592,8 +9592,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = user may choose to disable windows defender AV
-action.escu.creation_date = 2021-10-18
-action.escu.modification_date = 2021-10-18
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender Enhanced Notification - Rule
 action.escu.search_type = detection
@@ -9626,7 +9626,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_enhanced_notification_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_enhanced_notification_filter`
 
 [ESCU - Disable Defender MpEngine Registry - Rule]
 action.escu = 0
@@ -9637,8 +9637,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
-action.escu.creation_date = 2021-10-18
-action.escu.modification_date = 2021-10-18
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender MpEngine Registry - Rule
 action.escu.search_type = detection
@@ -9671,7 +9671,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_mpengine_registry_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_mpengine_registry_filter`
 
 [ESCU - Disable Defender Spynet Reporting - Rule]
 action.escu = 0
@@ -9682,8 +9682,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
-action.escu.creation_date = 2021-10-18
-action.escu.modification_date = 2021-10-18
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender Spynet Reporting - Rule
 action.escu.search_type = detection
@@ -9716,7 +9716,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_spynet_reporting_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_spynet_reporting_filter`
 
 [ESCU - Disable Defender Submit Samples Consent Feature - Rule]
 action.escu = 0
@@ -9727,8 +9727,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
-action.escu.creation_date = 2021-10-18
-action.escu.modification_date = 2021-10-18
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender Submit Samples Consent Feature - Rule
 action.escu.search_type = detection
@@ -9761,7 +9761,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_submit_samples_consent_feature_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_submit_samples_consent_feature_filter`
 
 [ESCU - Disable ETW Through Registry - Rule]
 action.escu = 0
@@ -9772,8 +9772,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = network operator may disable this feature of windows but not so common.
-action.escu.creation_date = 2021-06-22
-action.escu.modification_date = 2021-06-22
+action.escu.creation_date = 2022-01-27
+action.escu.modification_date = 2022-01-27
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable ETW Through Registry - Rule
 action.escu.search_type = detection
@@ -9788,7 +9788,7 @@ action.correlationsearch.label = ESCU - Disable ETW Through Registry - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible.
 action.notable.param.rule_title = Disable ETW Through Registry
 action.notable.param.security_domain = endpoint
@@ -9802,7 +9802,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_etw_through_registry_filter`
 
 [ESCU - Disable Logs Using WevtUtil - Rule]
 action.escu = 0
@@ -9858,8 +9858,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = admin may disable this application for non technical user.
-action.escu.creation_date = 2021-03-31
-action.escu.modification_date = 2021-03-31
+action.escu.creation_date = 2022-01-27
+action.escu.modification_date = 2022-01-27
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Registry Tool - Rule
 action.escu.search_type = detection
@@ -9878,7 +9878,7 @@ action.correlationsearch.label = ESCU - Disable Registry Tool - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion.
 action.notable.param.rule_title = Disable Registry Tool
 action.notable.param.security_domain = endpoint
@@ -9892,7 +9892,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_registry_tool_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_registry_tool_filter`
 
 [ESCU - Disable Schedule Task - Rule]
 action.escu = 0
@@ -9948,8 +9948,8 @@ action.escu.data_models = []
 action.escu.eli5 = This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = Unknown.
-action.escu.creation_date = 2021-10-05
-action.escu.modification_date = 2021-10-05
+action.escu.creation_date = 2022-01-27
+action.escu.modification_date = 2022-01-27
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Security Logs Using MiniNt Registry - Rule
 action.escu.search_type = detection
@@ -9982,7 +9982,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_security_logs_using_minint_registry_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_security_logs_using_minint_registry_filter`
 
 [ESCU - Disable Show Hidden Files - Rule]
 action.escu = 0
@@ -9993,8 +9993,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-03-31
-action.escu.modification_date = 2021-03-31
+action.escu.creation_date = 2022-01-27
+action.escu.modification_date = 2022-01-27
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Show Hidden Files - Rule
 action.escu.search_type = detection
@@ -10013,7 +10013,7 @@ action.correlationsearch.label = ESCU - Disable Show Hidden Files - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001", "T1564", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine.
 action.notable.param.rule_title = Disable Show Hidden Files
 action.notable.param.security_domain = endpoint
@@ -10027,7 +10027,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000") by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_show_hidden_files_filter`
 
 [ESCU - Disable UAC Remote Restriction - Rule]
 action.escu = 0
@@ -10038,8 +10038,8 @@ action.escu.data_models = []
 action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = admin may set this policy for non-critical machine.
-action.escu.creation_date = 2021-09-29
-action.escu.modification_date = 2021-09-29
+action.escu.creation_date = 2022-01-27
+action.escu.modification_date = 2022-01-27
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable UAC Remote Restriction - Rule
 action.escu.search_type = detection
@@ -10072,7 +10072,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_uac_remote_restriction_filter`
+search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_uac_remote_restriction_filter`
 
 [ESCU - Disable Windows App Hotkeys - Rule]
 action.escu = 0
@@ -10083,8 +10083,8 @@ action.escu.data_models = []
 action.escu.eli5 = This analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. This technique is used to impair the analyst in analyzing and removing the attacker implant in compromised systems.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-05-05
-action.escu.modification_date = 2021-05-05
+action.escu.creation_date = 2022-01-27
+action.escu.modification_date = 2022-01-27
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Windows App Hotkeys - Rule
 action.escu.search_type = detection
@@ -10117,7 +10117,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_name = "HotKey Disabled" AND Registry.registry_key_name = "Debugger" by Registry.dest Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_windows_app_hotkeys_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `disable_windows_app_hotkeys_filter`
 
 [ESCU - Disable Windows Behavior Monitoring - Rule]
 action.escu = 0
@@ -10128,8 +10128,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = admin or user may choose to disable this windows features.
-action.escu.creation_date = 2021-03-31
-action.escu.modification_date = 2021-03-31
+action.escu.creation_date = 2022-01-27
+action.escu.modification_date = 2022-01-27
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Windows Behavior Monitoring - Rule
 action.escu.search_type = detection
@@ -10148,7 +10148,7 @@ action.correlationsearch.label = ESCU - Disable Windows Behavior Monitoring - Ru
 action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections.
 action.notable.param.rule_title = Disable Windows Behavior Monitoring
 action.notable.param.security_domain = endpoint
@@ -10162,7 +10162,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_windows_behavior_monitoring_filter`
 
 [ESCU - Disable Windows SmartScreen Protection - Rule]
 action.escu = 0
@@ -10173,8 +10173,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = admin or user may choose to disable this windows features.
-action.escu.creation_date = 2021-03-31
-action.escu.modification_date = 2021-03-31
+action.escu.creation_date = 2022-01-27
+action.escu.modification_date = 2022-01-27
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Windows SmartScreen Protection - Rule
 action.escu.search_type = detection
@@ -10193,7 +10193,7 @@ action.correlationsearch.label = ESCU - Disable Windows SmartScreen Protection -
 action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload.
 action.notable.param.rule_title = Disable Windows SmartScreen Protection
 action.notable.param.security_domain = endpoint
@@ -10207,7 +10207,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled"  Registry.registry_value_name = "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled"  Registry.registry_value_data= "Off" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disable_windows_smartscreen_protection_filter`
 
 [ESCU - Disabling CMD Application - Rule]
 action.escu = 0
@@ -10218,8 +10218,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = admin may disable this application for non technical user.
-action.escu.creation_date = 2021-03-31
-action.escu.modification_date = 2021-03-31
+action.escu.creation_date = 2022-01-27
+action.escu.modification_date = 2022-01-27
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling CMD Application - Rule
 action.escu.search_type = detection
@@ -10238,7 +10238,7 @@ action.correlationsearch.label = ESCU - Disabling CMD Application - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files.
 action.notable.param.rule_title = Disabling CMD Application
 action.notable.param.security_domain = endpoint
@@ -10252,7 +10252,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disabling_cmd_application_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `disabling_cmd_application_filter`
 
 [ESCU - Disabling ControlPanel - Rule]
 action.escu = 0
@@ -10263,8 +10263,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = admin may disable this application for non technical user.
-action.escu.creation_date = 2021-03-31
-action.escu.modification_date = 2021-03-31
+action.escu.creation_date = 2022-01-27
+action.escu.modification_date = 2022-01-27
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling ControlPanel - Rule
 action.escu.search_type = detection
@@ -10283,7 +10283,7 @@ action.correlationsearch.label = ESCU - Disabling ControlPanel - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine.
 action.notable.param.rule_title = Disabling ControlPanel
 action.notable.param.security_domain = endpoint
@@ -10297,7 +10297,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `disabling_controlpanel_filter`
 
 [ESCU - Disabling Defender Services - Rule]
 action.escu = 0
@@ -10308,8 +10308,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
-action.escu.creation_date = 2021-10-20
-action.escu.modification_date = 2021-10-20
+action.escu.creation_date = 2022-01-28
+action.escu.modification_date = 2022-01-28
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling Defender Services - Rule
 action.escu.search_type = detection
@@ -10342,7 +10342,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*", "*WinDefend*", "*SecurityHealthService*"))  AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disabling_defender_services_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*")) AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `disabling_defender_services_filter`
 
 [ESCU - Disabling Firewall with Netsh - Rule]
 action.escu = 0
@@ -10398,8 +10398,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = admin may disable this application for non technical user.
-action.escu.creation_date = 2021-03-31
-action.escu.modification_date = 2021-03-31
+action.escu.creation_date = 2022-01-28
+action.escu.modification_date = 2022-01-28
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling FolderOptions Windows Feature - Rule
 action.escu.search_type = detection
@@ -10418,7 +10418,7 @@ action.correlationsearch.label = ESCU - Disabling FolderOptions Windows Feature
 action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions.
 action.notable.param.rule_title = Disabling FolderOptions Windows Feature
 action.notable.param.security_domain = endpoint
@@ -10432,7 +10432,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `disabling_folderoptions_windows_feature_filter`
 
 [ESCU - Disabling Net User Account - Rule]
 action.escu = 0
@@ -10488,8 +10488,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = admin may disable this application for non technical user.
-action.escu.creation_date = 2021-03-31
-action.escu.modification_date = 2021-03-31
+action.escu.creation_date = 2022-01-28
+action.escu.modification_date = 2022-01-28
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling NoRun Windows App - Rule
 action.escu.search_type = detection
@@ -10508,7 +10508,7 @@ action.correlationsearch.label = ESCU - Disabling NoRun Windows App - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut.
 action.notable.param.rule_title = Disabling NoRun Windows App
 action.notable.param.security_domain = endpoint
@@ -10522,7 +10522,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `disabling_norun_windows_app_filter`
 
 [ESCU - Disabling Remote User Account Control - Rule]
 action.escu = 0
@@ -10578,8 +10578,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine  difficult and keep their infection on the box.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = in some cases admin can disable systemrestore on a machine.
-action.escu.creation_date = 2021-03-31
-action.escu.modification_date = 2021-03-31
+action.escu.creation_date = 2022-01-28
+action.escu.modification_date = 2022-01-28
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling SystemRestore In Registry - Rule
 action.escu.search_type = detection
@@ -10598,7 +10598,7 @@ action.correlationsearch.label = ESCU - Disabling SystemRestore In Registry - Ru
 action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine  difficult and keep their infection on the box.
 action.notable.param.rule_title = Disabling SystemRestore In Registry
 action.notable.param.security_domain = endpoint
@@ -10612,7 +10612,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `disabling_systemrestore_in_registry_filter`
 
 [ESCU - Disabling Task Manager - Rule]
 action.escu = 0
@@ -10623,8 +10623,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = admin may disable this application for non technical user.
-action.escu.creation_date = 2021-03-31
-action.escu.modification_date = 2021-03-31
+action.escu.creation_date = 2022-01-28
+action.escu.modification_date = 2022-01-28
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling Task Manager - Rule
 action.escu.search_type = detection
@@ -10643,7 +10643,7 @@ action.correlationsearch.label = ESCU - Disabling Task Manager - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process.
 action.notable.param.rule_title = Disabling Task Manager
 action.notable.param.security_domain = endpoint
@@ -10657,7 +10657,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `disabling_task_manager_filter`
 
 [ESCU - Domain Account Discovery With Net App - Rule]
 action.escu = 0
@@ -11512,8 +11512,8 @@ action.escu.data_models = []
 action.escu.eli5 = This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-10-07
-action.escu.modification_date = 2021-10-07
+action.escu.creation_date = 2022-01-28
+action.escu.modification_date = 2022-01-28
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - ETW Registry Disabled - Rule
 action.escu.search_type = detection
@@ -11546,7 +11546,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*") Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `etw_registry_disabled_filter`
+search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `etw_registry_disabled_filter`
 
 [ESCU - Elevated Group Discovery With Net - Rule]
 action.escu = 0
@@ -11814,8 +11814,8 @@ action.escu.data_models = []
 action.escu.eli5 = This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-05-19
-action.escu.modification_date = 2021-05-19
+action.escu.creation_date = 2022-01-28
+action.escu.modification_date = 2022-01-28
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Enable RDP In Other Port Number - Rule
 action.escu.search_type = detection
@@ -11848,7 +11848,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `enable_rdp_in_other_port_number_filter`
 
 [ESCU - Enable WDigest UseLogonCredential Registry - Rule]
 action.escu = 0
@@ -11859,8 +11859,8 @@ action.escu.data_models = []
 action.escu.eli5 = This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-10-05
-action.escu.modification_date = 2021-10-05
+action.escu.creation_date = 2022-01-28
+action.escu.modification_date = 2022-01-28
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Enable WDigest UseLogonCredential Registry - Rule
 action.escu.search_type = detection
@@ -11893,7 +11893,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `enable_wdigest_uselogoncredential_registry_filter`
+search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `enable_wdigest_uselogoncredential_registry_filter`
 
 [ESCU - Enumerate Users Local Group Using Telegram - Rule]
 action.escu = 0
@@ -11993,8 +11993,8 @@ action.escu.data_models = []
 action.escu.eli5 = The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 action.escu.known_false_positives = Some false positives may be present and will need to be filtered.
-action.escu.creation_date = 2021-03-01
-action.escu.modification_date = 2021-03-01
+action.escu.creation_date = 2022-01-28
+action.escu.modification_date = 2022-01-28
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Eventvwr UAC Bypass - Rule
 action.escu.search_type = detection
@@ -12013,7 +12013,7 @@ action.correlationsearch.label = ESCU - Eventvwr UAC Bypass - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
 action.notable.param.rule_title = Eventvwr UAC Bypass
 action.notable.param.security_domain = endpoint
@@ -12027,7 +12027,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where  Registry.registry_path="*mscfile\\shell\\open\\command\\*"  by Registry.user, Registry.dest , Registry.registry_value_name| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `eventvwr_uac_bypass_filter`
+search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where  Registry.registry_path="*mscfile\\shell\\open\\command\\*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `eventvwr_uac_bypass_filter`
 
 [ESCU - Excel Spawning PowerShell - Rule]
 action.escu = 0
@@ -16001,8 +16001,8 @@ action.escu.data_models = []
 action.escu.eli5 = This analytic identifies a suspicious registry modification to hide a user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will create a hidden user account with Admin privileges in login screen to avoid noticing by the user that they already compromise and to persist on that said machine.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = Unknown. Filter as needed.
-action.escu.creation_date = 2021-05-05
-action.escu.modification_date = 2021-05-05
+action.escu.creation_date = 2022-01-28
+action.escu.modification_date = 2022-01-28
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Hide User Account From Sign-In Screen - Rule
 action.escu.search_type = detection
@@ -16035,7 +16035,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data = "0x00000000" by Registry.dest Registry.user Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `hide_user_account_from_sign_in_screen_filter`
+search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data = "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `hide_user_account_from_sign_in_screen_filter`
 
 [ESCU - Hiding Files And Directories With Attrib exe - Rule]
 action.escu = 0
@@ -23339,6 +23339,51 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`
 
+[ESCU - Potentially malicious code on commandline - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic uses a pretrained machine learning text classifier to detect potentially malicious commandlines.  The model identifies unusual combinations of keywords found in samples of commandlines where adversaries executed powershell code, primarily for C2 communication.  For example, adversaries will leverage IO capabilities such as "streamreader" and "webclient", threading capabilties such as "mutex" locks, programmatic constructs like "function" and "catch", and cryptographic operations like "computehash".  Although observing one of these keywords in a commandline script is possible, combinations of keywords observed in attack data are not typically found in normal usage of the commandline.  The model will output a score where all values above zero are suspicious, anything greater than one particularly so.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"]}
+action.escu.data_models = ["\"Endpoint"]
+action.escu.eli5 = The following analytic uses a pretrained machine learning text classifier to detect potentially malicious commandlines.  The model identifies unusual combinations of keywords found in samples of commandlines where adversaries executed powershell code, primarily for C2 communication.  For example, adversaries will leverage IO capabilities such as "streamreader" and "webclient", threading capabilties such as "mutex" locks, programmatic constructs like "function" and "catch", and cryptographic operations like "computehash".  Although observing one of these keywords in a commandline script is possible, combinations of keywords observed in attack data are not typically found in normal usage of the commandline.  The model will output a score where all values above zero are suspicious, anything greater than one particularly so.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.  You will also need to install the Machine Learning Toolkit version 5.3 or above to apply the pretrained model.
+action.escu.known_false_positives = This model is an anomaly detector that identifies usage of APIs and scripting constructs that are correllated with malicious activity.  These APIs and scripting constructs are part of the programming langauge and advanced scripts may generate false positives.
+action.escu.creation_date = 2022-01-14
+action.escu.modification_date = 2022-01-14
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Potentially malicious code on commandline - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Suspicious Command-Line Executions"]
+action.risk = 1
+action.risk.param._risk_message = Unusual command-line execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 12}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 12}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Potentially malicious code on commandline - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions"], "confidence": 20, "context": ["source:endpoint", "stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['user', 'dest']
+action.notable.param.rule_description = The following analytic uses a pretrained machine learning text classifier to detect potentially malicious commandlines.  The model identifies unusual combinations of keywords found in samples of commandlines where adversaries executed powershell code, primarily for C2 communication.  For example, adversaries will leverage IO capabilities such as "streamreader" and "webclient", threading capabilties such as "mutex" locks, programmatic constructs like "function" and "catch", and cryptographic operations like "computehash".  Although observing one of these keywords in a commandline script is possible, combinations of keywords observed in attack data are not typically found in normal usage of the commandline.  The model will output a score where all values above zero are suspicious, anything greater than one particularly so.
+action.notable.param.rule_title = Potentially malicious code on commandline
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel="Endpoint.Processes" by Processes.parent_process_name Processes.process_name Processes.process Processes.user Processes.dest  | `drop_dm_object_name(Processes)`  | where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score` | apply unusual_commandline_detection | eval score='predicted(unusual_cmdline_logits)', process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits) orig_process | where score > 0.5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `potentially_malicious_code_on_commandline_filter`
+
 [ESCU - PowerShell - Connect To Internet With Hidden Window - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -25225,8 +25270,8 @@ action.escu.data_models = []
 action.escu.eli5 = The search looks for modifications to registry keys that can be used to launch an application or service at system startup.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task.
-action.escu.creation_date = 2021-09-07
-action.escu.modification_date = 2021-09-07
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Registry Keys Used For Persistence - Rule
 action.escu.search_type = detection
@@ -25259,7 +25304,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `registry_keys_used_for_persistence_filter`
 
 [ESCU - Registry Keys Used For Privilege Escalation - Rule]
 action.escu = 0
@@ -25270,8 +25315,8 @@ action.escu.data_models = []
 action.escu.eli5 = This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task.
-action.escu.creation_date = 2020-11-27
-action.escu.modification_date = 2020-11-27
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Registry Keys Used For Privilege Escalation - Rule
 action.escu.search_type = detection
@@ -25304,7 +25349,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger) by Registry.dest  Registry.user Registry.registry_path Registry.registry_value_name | `security_content_ctime(lastTime)`  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_privilege_escalation_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger) by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `registry_keys_used_for_privilege_escalation_filter`
 
 [ESCU - Registry Keys for Creating SHIM Databases - Rule]
 action.escu = 0
@@ -25495,8 +25540,8 @@ action.escu.data_models = []
 action.escu.eli5 = This search detects registry key license at host where Remcos RAT agent is installed.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-09-24
-action.escu.modification_date = 2021-09-24
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remcos client registry install entry - Rule
 action.escu.search_type = detection
@@ -25529,7 +25574,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Registry.registry_path) as  registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest  Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`remcos_client_registry_install_entry_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data |`remcos_client_registry_install_entry_filter`
 
 [ESCU - Remote Desktop Network Bruteforce - Rule]
 action.escu = 0
@@ -26375,8 +26420,8 @@ action.escu.data_models = []
 action.escu.eli5 = This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host.
 action.escu.how_to_implement = to successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-06-02
-action.escu.modification_date = 2021-06-02
+action.escu.creation_date = 2021-01-26
+action.escu.modification_date = 2021-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Revil Registry Entry - Rule
 action.escu.search_type = detection
@@ -26409,7 +26454,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`
+search = | tstats `security_content_summariesonly` count  FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `revil_registry_entry_filter`
 
 [ESCU - RunDLL Loading DLL By Ordinal - Rule]
 action.escu = 0
@@ -28934,8 +28979,8 @@ action.escu.data_models = []
 action.escu.eli5 = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = updated windows application needed in safe boot may used this registry
-action.escu.creation_date = 2021-06-10
-action.escu.modification_date = 2021-06-10
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Start Up During Safe Mode Boot - Rule
 action.escu.search_type = detection
@@ -28954,7 +28999,7 @@ action.correlationsearch.label = ESCU - Start Up During Safe Mode Boot - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot.
 action.notable.param.rule_title = Start Up During Safe Mode Boot
 action.notable.param.security_domain = endpoint
@@ -28968,7 +29013,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `start_up_during_safe_mode_boot_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `start_up_during_safe_mode_boot_filter`
 
 [ESCU - Sunburst Correlation DLL and Network Event - Rule]
 action.escu = 0
@@ -31256,14 +31301,14 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 [ESCU - Time Provider Persistence Registry - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
+description = This analytic is to detect a suspicious modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.003", "T1547"]}
 action.escu.data_models = []
-action.escu.eli5 = This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
+action.escu.eli5 = This analytic is to detect a suspicious modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-09-29
-action.escu.modification_date = 2021-09-29
+action.escu.creation_date = 2022-01-26
+action.escu.modification_date = 2022-01-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Time Provider Persistence Registry - Rule
 action.escu.search_type = detection
@@ -31283,7 +31328,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = ['user', 'dest']
-action.notable.param.rule_description = This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
+action.notable.param.rule_description = This analytic is to detect a suspicious modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
 action.notable.param.rule_title = Time Provider Persistence Registry
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -31296,7 +31341,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `time_provider_persistence_registry_filter`
+search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `time_provider_persistence_registry_filter`
 
 [ESCU - Trickbot Named Pipe - Rule]
 action.escu = 0
@@ -34111,9 +34156,9 @@ CallTrace Stack trace of where open process is called. Included is the DLL and t
 dbgcore.dll or dbghelp.dll  are two core Windows debug DLLs that have minidump functions which provide a way for applications to produce crashdump files that contain a useful subset of the entire process context. \
 The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory, used to execute this module which is related to lsass dumping.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
-action.escu.known_false_positives = False positives will occur based on GrantedAccess, filter based on source image as needed.
-action.escu.creation_date = 2022-01-10
-action.escu.modification_date = 2022-01-10
+action.escu.known_false_positives = False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught.
+action.escu.creation_date = 2022-01-27
+action.escu.modification_date = 2022-01-27
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Possible Credential Dumping - Rule
 action.escu.search_type = detection
@@ -34150,7 +34195,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x1438", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`
+search = `sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`
 
 [ESCU - Windows Raccine Scheduled Task Deletion - Rule]
 action.escu = 0

dist/escu/default/transforms.conf

@@ -1,10 +1,17 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-01-26T22:49:42 UTC
+# On Date: 2022-01-31T19:58:16 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
 
+[__mlspl_unusual_commandline_detection]
+filename = __mlspl_unusual_commandline_detection.mlmodel
+default_match = false
+case_sensitive_match = false
+# description = An MLTK model for detecting malicious commandlines
+min_matches = 1
+
 [api_call_by_user_baseline]
 collection = api_call_by_user_baseline
 external_type = kvstore
@@ -223,6 +230,12 @@ filename = previously_seen_cmd_line_arguments.csv
 filename = previously_seen_ec2_modifications_by_user.csv
 # description = A place holder for a list of AWS EC2 modifications done by each user
 
+[previously_seen_gcp_storage_access_from_remote_ip]
+filename = previously_seen_gcp_storage_access_from_remote_ip.csv
+default_match = false
+# description = A place holder for a list of GCP storage access from remote IPs
+min_matches = 1
+
 [previously_seen_running_windows_services]
 collection = previously_seen_running_windows_services
 external_type = kvstore

dist/escu/lookups/previously_seen_gcp_storage_access_from_remote_ip.csv

@@ -0,0 +1 @@
+firstTime, lastTime, bucket_name, remote_ip, operation, request_uri 

docs/_data/navigation.yml

@@ -56,6 +56,8 @@ detections:
         url: /detections/endpoint_filesystem/
       - title: Endpoint_Processes
         url: /detections/endpoint_processes/
+      - title: Endpoint_Registry
+        url: /detections/endpoint_registry/
       - title: Network_Resolution
         url: /detections/network_resolution/
       - title: Network_Sessions

docs/_pages/detections.md

@@ -51,6 +51,7 @@ sidebar:
 | [Allow Operation with Consent Admin](/endpoint/allow_operation_with_consent_admin/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Amazon EKS Kubernetes Pod scan detection](/cloud/amazon_eks_kubernetes_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | Hunting |
 | [Amazon EKS Kubernetes cluster scan detection](/cloud/amazon_eks_kubernetes_cluster_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | Hunting |
+| [Anomalous Usage of Account Credentials](/endpoint/anomalous_usage_of_account_credentials/) | [Domain Accounts](/tags/#domain-accounts) | Anomaly |
 | [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Anomaly |
 | [Anomalous usage of Archive Tools](/endpoint/anomalous_usage_of_archive_tools/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Anomaly |
 | [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
@@ -85,6 +86,7 @@ sidebar:
 | [Circle CI Disable Security Job](/cloud/circle_ci_disable_security_job/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | Anomaly |
 | [Circle CI Disable Security Step](/cloud/circle_ci_disable_security_step/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | Anomaly |
 | [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
+| [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
 | [Clop Common Exec Parameter](/endpoint/clop_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP |
 | [Clop Ransomware Known Service Name](/endpoint/clop_ransomware_known_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP |
 | [Cloud API Calls From Previously Unseen User Roles](/cloud/cloud_api_calls_from_previously_unseen_user_roles/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly |
@@ -216,6 +218,7 @@ sidebar:
 | [Detection of tools built by NirSoft](/endpoint/detection_of_tools_built_by_nirsoft/) | [Software Deployment Tools](/tags/#software-deployment-tools) | TTP |
 | [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender AntiVirus Registry](/endpoint/disable_defender_antivirus_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
+| [Disable Defender AntiVirus Registry](/experimental/disable_defender_antivirus_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender BlockAtFirstSeen Feature](/endpoint/disable_defender_blockatfirstseen_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender Enhanced Notification](/endpoint/disable_defender_enhanced_notification/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender MpEngine Registry](/endpoint/disable_defender_mpengine_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
@@ -355,6 +358,7 @@ sidebar:
 | [Gsuite suspicious calendar invite](/cloud/gsuite_suspicious_calendar_invite/) | [Phishing](/tags/#phishing) | Hunting |
 | [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [High Frequency Copy Of Files In Network Share](/endpoint/high_frequency_copy_of_files_in_network_share/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | Anomaly |
@@ -501,6 +505,7 @@ sidebar:
 | [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell) | TTP |
 | [Potential Pass the Token or Hash Observed at the Destination Device](/endpoint/potential_pass_the_token_or_hash_observed_at_the_destination_device/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP |
 | [Potential Pass the Token or Hash Observed by an Event Collecting Device](/endpoint/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP |
+| [Potentially malicious code on commandline](/endpoint/potentially_malicious_code_on_commandline/) | [Windows Command Shell](/tags/#windows-command-shell) | Anomaly |
 | [PowerShell - Connect To Internet With Hidden Window](/endpoint/powershell_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Hunting |
 | [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | Hunting |
 | [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |

docs/_pages/endpoint_registry.md

@@ -0,0 +1,9 @@
+---
+title: Endpoint_Registry
+layout: tag
+author_profile: false
+taxonomy: Endpoint_Registry
+permalink: /detections/endpoint_registry/
+sidebar:
+  nav: "detections"
+---

docs/_playbooks/delete_detected_files.md

@@ -293,6 +293,9 @@ This playbook acts upon events where a file has been determined to be malicious
 
 
 
+
+
+
 
 
 
@@ -769,6 +772,8 @@ This playbook acts upon events where a file has been determined to be malicious
 
 
 
+
+
 
 
 

docs/_playbooks/log4j_investigate.md

@@ -123,6 +123,8 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
 
 
 
@@ -1456,6 +1458,14 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
+
 
 
 
@@ -1891,6 +1901,10 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
 
 
 
@@ -3355,6 +3369,16 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -4228,6 +4252,11 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
 
 
 
@@ -4899,6 +4928,11 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
 
 
 
@@ -5647,6 +5681,11 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
 
 
 
@@ -6145,6 +6184,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
 
 
 
@@ -6742,6 +6784,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
 
 
 

docs/_playbooks/log4j_respond.md

@@ -123,6 +123,8 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
 
 
 
@@ -1456,6 +1458,14 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
+
 
 
 
@@ -1891,6 +1901,10 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
 
 
 
@@ -3355,6 +3369,16 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -4228,6 +4252,11 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
 
 
 
@@ -4899,6 +4928,11 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
 
 
 
@@ -5647,6 +5681,11 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
 
 
 
@@ -6145,6 +6184,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
 
 
 
@@ -6742,6 +6784,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
 
 
 

docs/_playbooks/ransomware_investigate_and_contain.md

@@ -115,6 +115,8 @@ This playbook investigates and contains ransomware detected on endpoints.
 
 
 
+
+
 
 
 
@@ -772,6 +774,9 @@ This playbook investigates and contains ransomware detected on endpoints.
 
 
 
+
+
+
 
 
 

docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md

@@ -51,9 +51,9 @@ This search looks at GCP Storage bucket-access logs and detects new or previousl
 | search status="\"200\"" 
 | stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip operation request_uri 
 | table firstTime, lastTime, bucket_name, remote_ip, operation, request_uri 
-| inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip.csv 
+| inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip 
 | stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip operation request_uri 
-| outputlookup previously_seen_gcp_storage_access_from_remote_ip.csv 
+| outputlookup previously_seen_gcp_storage_access_from_remote_ip 
 | eval newIP=if(firstTime >= relative_time(now(),"-70m@m"), 1, 0) 
 | where newIP=1 
 | eval first_time=strftime(firstTime,"%m/%d/%y %H:%M:%S") 

docs/_posts/2021-01-26-revil_registry_entry.md

@@ -3,7 +3,7 @@ title: "Revil Registry Entry"
 excerpt: "Modify Registry"
 categories:
   - Endpoint
-last_modified_at: 2021-06-02
+last_modified_at: 2021-01-26
 toc: true
 toc_label: ""
 tags:
@@ -26,7 +26,7 @@ This analytic identifies suspicious modification in registry entry to keep some
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-06-02
+- **Last Updated**: 2021-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: e3d3f57a-c381-11eb-9e35-acde48001122
 
@@ -41,10 +41,15 @@ This analytic identifies suspicious modification in registry entry to keep some
 
 ```
 
-| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+| tstats `security_content_summariesonly` count  FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `revil_registry_entry_filter`
 ```
 
@@ -97,4 +102,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/revil_registry_entry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/revil_registry_entry.yml) \| *version*: **2**

docs/_posts/2021-12-07-anomalous_usage_of_account_credentials.md

@@ -0,0 +1,102 @@
+---
+title: "Anomalous Usage of Account Credentials"
+excerpt: "Domain Accounts"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-07
+toc: true
+toc_label: ""
+tags:
+  - Domain Accounts
+  - Defense Evasion
+  - Persistence
+  - Privilege Escalation
+  - Initial Access
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This is an anomaly generating detection looking for multiple interactive logins within a specific time period. An insider threat may attempt to steal colleagues credentials in low tech, undetectable methods, in order to gain access to additional information or to hide their own behavior. This should capture their attempted use of those credentials on a workstation.
+
+- **Type**: Anomaly
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2021-12-07
+- **Author**: Lou Stella, Splunk
+- **ID**: 629cbf9e-5785-11ec-9611-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "dest_user_original_artifact"), "string", null), signature_id=ucast(map_get(input_event, "EventCode"), "string", null) 
+| where signature_id="4624" 
+| where auth_type="2" OR auth_type="11" 
+| where NOT (src_user="SYSTEM") AND NOT (src_user="ANONYMOUS LOGON") 
+| stats estdc(src_user) AS user_counter by device, span(timestamp, 600s, 300s) 
+| where user_counter>=2  
+| rename window_end AS timestamp 
+| eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) 
+| into write_ssa_detected_events();
+```
+
+#### Associated Analytic Story
+* [Insider Threat](/stories/insider_threat)
+
+
+#### How To Implement
+To successfully implement this detection, you need to be ingesting logon events from workstations.
+
+#### Required field
+* _time
+
+
+#### Kill Chain Phase
+* Privilege Escalation
+* Lateral Movement
+
+
+#### Known False Positives
+Shared workstations can cause false positives
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 6.0 | 20 | 30 | Multiple interactive logins detected on $device$ |
+
+
+
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1078/002/](https://attack.mitre.org/techniques/T1078/002/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_login/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_login/windows-security.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/anomalous_usage_of_account_credentials.yml) \| *version*: **1**

docs/_posts/2021-12-08-disable_defender_antivirus_registry.md

@@ -0,0 +1,103 @@
+---
+title: "Disable Defender AntiVirus Registry"
+excerpt: "Disable or Modify Tools, Impair Defenses"
+categories:
+  - Experimental
+last_modified_at: 2021-12-08
+toc: true
+toc_label: ""
+tags:
+  - Disable or Modify Tools
+  - Defense Evasion
+  - Impair Defenses
+  - Defense Evasion
+  - Splunk Behavioral Analytics
+  - Endpoint_Registry
+---
+
+### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+
+- **Type**: TTP
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Registry](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointRegistry)
+- **Last Updated**: 2021-12-08
+- **Author**: Bhavin Patel, Splunk
+- **ID**: aa4f115a-3024-11ec-9987-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"), "string", null)), registry_value_data=ucast(map_get(input_event, "registry_value_data"), "string", null), process_guid=ucast(map_get(input_event, "process_guid"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where like(registry_path, "%\\Policies\\Microsoft\\Windows Defender%") AND registry_key_name="DisableAntiVirus" AND registry_value_data="(0x00000001)" 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map( [ "event_id", event_id, "registry_path", registry_path, "registry_key_name", registry_key_name, "process_guid", process_guid,"registry_value_data",registry_value_data]) 
+| into write_ssa_detected_events();
+```
+
+#### Associated Analytic Story
+* [IceID](/stories/iceid)
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Required field
+* _time
+* Registry.dest
+* Registry.user
+* Registry.registry_value_name
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.registry_value_data
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+#### Known False Positives
+Admin or user may choose to disable windows defender product
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | Modified/added/deleted registry entry $registry_path$ in $dest$ |
+
+
+
+
+#### Reference
+
+* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/experimental/disable_defender_antivirus_registry.yml) \| *version*: **1**

docs/_posts/2021-12-20-clear_unallocated_sector_using_cipher_app.md

@@ -0,0 +1,108 @@
+---
+title: "Clear Unallocated Sector Using Cipher App"
+excerpt: "File Deletion, Indicator Removal on Host"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-20
+toc: true
+toc_label: ""
+tags:
+  - File Deletion
+  - Defense Evasion
+  - Indicator Removal on Host
+  - Defense Evasion
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files.
+
+- **Type**: TTP
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2021-12-20
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 8f907d90-6173-11ec-9c23-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1070.004](https://attack.mitre.org/techniques/T1070/004/) | File Deletion | Defense Evasion |
+
+| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND like(cmd_line, "%/w:%") AND process_name="cipher.exe" 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Associated Analytic Story
+* [Ransomware](/stories/ransomware)
+* [Information Sabotage](/stories/information_sabotage)
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+#### Known False Positives
+administrator may execute this app to manage disk
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. |
+
+
+
+
+#### Reference
+
+* [https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/](https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/)
+* [https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf](https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml) \| *version*: **1**

docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md

@@ -0,0 +1,97 @@
+---
+title: "Hiding Files And Directories With Attrib exe"
+excerpt: "Windows File and Directory Permissions Modification, File and Directory Permissions Modification"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-20
+toc: true
+toc_label: ""
+tags:
+  - Windows File and Directory Permissions Modification
+  - Defense Evasion
+  - File and Directory Permissions Modification
+  - Defense Evasion
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file.  The search looks for specific command-line arguments to detect the use of attrib.exe to hide files.
+
+- **Type**: TTP
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2021-12-20
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 028e4406-6176-11ec-aec2-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1222.001](https://attack.mitre.org/techniques/T1222/001/) | Windows File and Directory Permissions Modification | Defense Evasion |
+
+| [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND like(cmd_line, "%+h%") AND process_name="attrib.exe" 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Associated Analytic Story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Information Sabotage](/stories/information_sabotage)
+
+
+#### How To Implement
+You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
+
+#### Required field
+* _time
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+#### Known False Positives
+Some applications and users may legitimately use attrib.exe to interact with the files. 
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 72.0 | 80 | 90 | Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. |
+
+
+
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml) \| *version*: **1**

docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md

@@ -0,0 +1,106 @@
+---
+title: "Potentially malicious code on commandline"
+excerpt: "Windows Command Shell"
+categories:
+  - Endpoint
+last_modified_at: 2022-01-14
+toc: true
+toc_label: ""
+tags:
+  - Windows Command Shell
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic uses a pretrained machine learning text classifier to detect potentially malicious commandlines.  The model identifies unusual combinations of keywords found in samples of commandlines where adversaries executed powershell code, primarily for C2 communication.  For example, adversaries will leverage IO capabilities such as "streamreader" and "webclient", threading capabilties such as "mutex" locks, programmatic constructs like "function" and "catch", and cryptographic operations like "computehash".  Although observing one of these keywords in a commandline script is possible, combinations of keywords observed in attack data are not typically found in normal usage of the commandline.  The model will output a score where all values above zero are suspicious, anything greater than one particularly so.
+
+- **Type**: Anomaly
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-01-14
+- **Author**: Michael Hart, Splunk
+- **ID**: 9c53c446-757e-11ec-871d-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel="Endpoint.Processes" by Processes.parent_process_name Processes.process_name Processes.process Processes.user Processes.dest  
+| `drop_dm_object_name(Processes)`  
+| where len(process) > 200 
+| `potentially_malicious_code_on_cmdline_tokenize_score` 
+| apply unusual_commandline_detection 
+| eval score='predicted(unusual_cmdline_logits)', process=orig_process 
+| fields - unusual_cmdline* predicted(unusual_cmdline_logits) orig_process 
+| where score > 0.5 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `potentially_malicious_code_on_commandline_filter`
+```
+
+#### Associated Analytic Story
+* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.  You will also need to install the Machine Learning Toolkit version 5.3 or above to apply the pretrained model.
+
+#### Required field
+* _time
+* Processes.process
+* Processes.parent_process_name
+* Processes.process_name
+* Processes.parent_process
+* Processes.user
+* Processes.dest
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+#### Known False Positives
+This model is an anomaly detector that identifies usage of APIs and scripting constructs that are correllated with malicious activity.  These APIs and scripting constructs are part of the programming langauge and advanced scripts may generate false positives.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 12.0 | 60 | 20 | Unusual command-line execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$ |
+
+
+
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1059/003/](https://attack.mitre.org/techniques/T1059/003/)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/malicious_cmd_line_samples/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/malicious_cmd_line_samples/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/potentially_malicious_code_on_commandline.yml) \| *version*: **1**

docs/_posts/2022-01-26-active_setup_registry_autostart.md

@@ -3,7 +3,7 @@ title: "Active Setup Registry Autostart"
 excerpt: "Active Setup, Boot or Logon Autostart Execution"
 categories:
   - Endpoint
-last_modified_at: 2021-09-28
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -30,7 +30,7 @@ This analytic is to detect a suspicious modification of the active setup registr
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-09-28
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: f64579c0-203f-11ec-abcc-acde48001122
 
@@ -47,10 +47,15 @@ This analytic is to detect a suspicious modification of the active setup registr
 
 ```
 
-| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `active_setup_registry_autostart_filter`
 ```
 
@@ -103,4 +108,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/active_setup_registry_autostart.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/active_setup_registry_autostart.yml) \| *version*: **2**

docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md

@@ -3,7 +3,7 @@ title: "Add DefaultUser And Password In Registry"
 excerpt: "Credentials in Registry, Unsecured Credentials"
 categories:
   - Endpoint
-last_modified_at: 2021-09-06
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ this search is to detect a suspicious registry modification to implement auto ad
 - **Type**: Anomaly
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-09-06
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: d4a3eb62-0f1e-11ec-a971-acde48001122
 
@@ -45,10 +45,15 @@ this search is to detect a suspicious registry modification to implement auto ad
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_value_data Registry.registry_key_name 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `add_defaultuser_and_password_in_registry_filter`
 ```
 
@@ -98,4 +103,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml) \| *version*: **2**

docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md

@@ -3,7 +3,7 @@ title: "Allow Inbound Traffic By Firewall Rule Registry"
 excerpt: "Remote Desktop Protocol, Remote Services"
 categories:
   - Endpoint
-last_modified_at: 2021-05-26
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This analytic detects a potential suspicious modification of firewall rule regis
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-05-26
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 0a46537c-be02-11eb-92ca-acde48001122
 
@@ -45,17 +45,22 @@ This analytic detects a potential suspicious modification of firewall rule regis
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_name = "*
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*
 |Action=Allow
-|*" Registry.registry_value_name = "*
+|*" Registry.registry_value_data = "*
 |Dir=In
-|*" Registry.registry_value_name = "*
+|*" Registry.registry_value_data = "*
 |Profile=Public
-|*" Registry.registry_value_name = "*
-|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user Registry.registry_value_name Registry.dest 
+|*" Registry.registry_value_data = "*
+|LPort=*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `allow_inbound_traffic_by_firewall_rule_registry_filter`
 ```
 
@@ -106,4 +111,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml) \| *version*: **2**

docs/_posts/2022-01-26-allow_operation_with_consent_admin.md

@@ -3,7 +3,7 @@ title: "Allow Operation with Consent Admin"
 excerpt: "Abuse Elevation Control Mechanism"
 categories:
   - Endpoint
-last_modified_at: 2021-06-10
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -27,7 +27,7 @@ This analytic identifies a potential privilege escalation attempt to perform mal
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-06-10
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 7de17d7a-c9d8-11eb-a812-acde48001122
 
@@ -42,10 +42,15 @@ This analytic identifies a potential privilege escalation attempt to perform mal
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `allow_operation_with_consent_admin_filter`
 ```
 
@@ -96,4 +101,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/allow_operation_with_consent_admin.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/allow_operation_with_consent_admin.yml) \| *version*: **2**

docs/_posts/2022-01-26-disable_amsi_through_registry.md

@@ -3,7 +3,7 @@ title: "Disable AMSI Through Registry"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-06-22
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ this search is to identify modification in registry to disable AMSI windows feat
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-06-22
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 9c27ec42-d338-11eb-9044-acde48001122
 
@@ -45,10 +45,15 @@ this search is to identify modification in registry to disable AMSI windows feat
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_amsi_through_registry_filter`
 ```
 
@@ -94,4 +99,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_amsi_through_registry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_amsi_through_registry.yml) \| *version*: **2**

docs/_posts/2022-01-26-disable_defender_antivirus_registry.md

@@ -3,7 +3,7 @@ title: "Disable Defender AntiVirus Registry"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-10-18
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This particular behavior is typically executed when an adversaries or malware ga
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-10-18
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: aa4f695a-3024-11ec-9987-acde48001122
 
@@ -45,10 +45,15 @@ This particular behavior is typically executed when an adversaries or malware ga
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data = 0x00000001 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_defender_antivirus_registry_filter`
 ```
 
@@ -100,4 +105,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_antivirus_registry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_antivirus_registry.yml) \| *version*: **2**

docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md

@@ -3,7 +3,7 @@ title: "Disable Defender BlockAtFirstSeen Feature"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-10-18
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This analytic is to detect a suspicious modification of registry to disable wind
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-10-18
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras
 - **ID**: 2dd719ac-3021-11ec-97b4-acde48001122
 
@@ -45,10 +45,15 @@ This analytic is to detect a suspicious modification of registry to disable wind
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_defender_blockatfirstseen_feature_filter`
 ```
 
@@ -100,4 +105,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml) \| *version*: **2**

docs/_posts/2022-01-26-disable_defender_enhanced_notification.md

@@ -3,7 +3,7 @@ title: "Disable Defender Enhanced Notification"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-10-18
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This analytic is to detect a suspicious modification of registry to disable wind
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-10-18
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: dc65678c-301f-11ec-8e30-acde48001122
 
@@ -45,10 +45,15 @@ This analytic is to detect a suspicious modification of registry to disable wind
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_defender_enhanced_notification_filter`
 ```
 
@@ -100,4 +105,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_enhanced_notification.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_enhanced_notification.yml) \| *version*: **2**

docs/_posts/2022-01-26-disable_defender_mpengine_registry.md

@@ -3,7 +3,7 @@ title: "Disable Defender MpEngine Registry"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-10-18
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This particular behavior is typically executed when an adversaries or malware ga
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-10-18
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: cc391750-3024-11ec-955a-acde48001122
 
@@ -45,10 +45,15 @@ This particular behavior is typically executed when an adversaries or malware ga
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_defender_mpengine_registry_filter`
 ```
 
@@ -100,4 +105,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_mpengine_registry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_mpengine_registry.yml) \| *version*: **2**

docs/_posts/2022-01-26-disable_defender_spynet_reporting.md

@@ -3,7 +3,7 @@ title: "Disable Defender Spynet Reporting"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-10-18
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This analytic is to detect a suspicious modification of registry to disable wind
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-10-18
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 898debf4-3021-11ec-ba7c-acde48001122
 
@@ -45,10 +45,15 @@ This analytic is to detect a suspicious modification of registry to disable wind
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_defender_spynet_reporting_filter`
 ```
 
@@ -100,4 +105,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_spynet_reporting.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_spynet_reporting.yml) \| *version*: **2**

docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md

@@ -3,7 +3,7 @@ title: "Disable Defender Submit Samples Consent Feature"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-10-18
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ his analytic is to detect a suspicious modification of registry to disable windo
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-10-18
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 73922ff8-3022-11ec-bf5e-acde48001122
 
@@ -45,10 +45,15 @@ his analytic is to detect a suspicious modification of registry to disable windo
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_defender_submit_samples_consent_feature_filter`
 ```
 
@@ -100,4 +105,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml) \| *version*: **2**

docs/_posts/2022-01-26-registry_keys_used_for_persistence.md

@@ -3,7 +3,7 @@ title: "Registry Keys Used For Persistence"
 excerpt: "Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution"
 categories:
   - Endpoint
-last_modified_at: 2021-09-07
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -30,8 +30,8 @@ The search looks for modifications to registry keys that can be used to launch a
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-09-07
-- **Author**: Jose Hernandez, David Dorsey, Splunk
+- **Last Updated**: 2022-01-26
+- **Author**: Jose Hernandez, David Dorsey, Teoderick Contreras, Splunk
 - **ID**: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
 
 
@@ -47,10 +47,15 @@ The search looks for modifications to registry keys that can be used to launch a
 
 ```
 
-| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name 
 | `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `registry_keys_used_for_persistence_filter`
 ```
 
@@ -105,4 +110,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/registry_keys_used_for_persistence.yml) \| *version*: **6**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/registry_keys_used_for_persistence.yml) \| *version*: **7**

docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md

@@ -3,7 +3,7 @@ title: "Registry Keys Used For Privilege Escalation"
 excerpt: "Image File Execution Options Injection, Event Triggered Execution"
 categories:
   - Endpoint
-last_modified_at: 2020-11-27
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -29,8 +29,8 @@ This search looks for modifications to registry keys that can be used to elevate
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
-- **Last Updated**: 2020-11-27
-- **Author**: David Dorsey, Splunk
+- **Last Updated**: 2022-01-26
+- **Author**: David Dorsey, Teoderick Contreras, Splunk
 - **ID**: c9f4b923-f8af-4155-b697-1354f5bcbc5e
 
 
@@ -46,10 +46,15 @@ This search looks for modifications to registry keys that can be used to elevate
 
 ```
 
-| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger) by Registry.dest  Registry.user Registry.registry_path Registry.registry_value_name 
-| `security_content_ctime(lastTime)`  
-| `security_content_ctime(firstTime)` 
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger) by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name 
 | `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `registry_keys_used_for_privilege_escalation_filter`
 ```
 
@@ -101,4 +106,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml) \| *version*: **4**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml) \| *version*: **5**

docs/_posts/2022-01-26-remcos_client_registry_install_entry.md

@@ -3,7 +3,7 @@ title: "Remcos client registry install entry"
 excerpt: "Modify Registry"
 categories:
   - Endpoint
-last_modified_at: 2021-09-24
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -26,8 +26,8 @@ This search detects registry key license at host where Remcos RAT agent is insta
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-09-24
-- **Author**: Bhavin Patel, Rod Soto, Splunk
+- **Last Updated**: 2022-01-26
+- **Author**: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk
 - **ID**: f2a1615a-1d63-11ec-97d2-acde48001122
 
 
@@ -41,10 +41,15 @@ This search detects registry key license at host where Remcos RAT agent is insta
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Registry.registry_path) as  registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest  Registry.user Registry.registry_key_name Registry.process_id
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)`
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 |`remcos_client_registry_install_entry_filter`
 ```
 
@@ -95,4 +100,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/remcos_client_registry_install_entry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/remcos_client_registry_install_entry.yml) \| *version*: **2**

docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md

@@ -3,7 +3,7 @@ title: "Start Up During Safe Mode Boot"
 excerpt: "Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution"
 categories:
   - Endpoint
-last_modified_at: 2021-06-10
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -30,7 +30,7 @@ This search is to detect a modification or registry add to the safeboot registry
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-06-10
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: c6149154-c9d8-11eb-9da7-acde48001122
 
@@ -47,10 +47,15 @@ This search is to detect a modification or registry add to the safeboot registry
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `start_up_during_safe_mode_boot_filter`
 ```
 
@@ -100,4 +105,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/start_up_during_safe_mode_boot.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/start_up_during_safe_mode_boot.yml) \| *version*: **2**

docs/_posts/2022-01-26-time_provider_persistence_registry.md

@@ -3,7 +3,7 @@ title: "Time Provider Persistence Registry"
 excerpt: "Time Providers, Boot or Logon Autostart Execution"
 categories:
   - Endpoint
-last_modified_at: 2021-09-29
+last_modified_at: 2022-01-26
 toc: true
 toc_label: ""
 tags:
@@ -25,12 +25,12 @@ tags:
 
 #### Description
 
-This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
+This analytic is to detect a suspicious modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
 
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-09-29
+- **Last Updated**: 2022-01-26
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 5ba382c4-2105-11ec-8d8f-acde48001122
 
@@ -47,10 +47,15 @@ This analytic is to detect a suspiciouos modification of time provider registry
 
 ```
 
-| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `time_provider_persistence_registry_filter`
 ```
 
@@ -103,4 +108,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/time_provider_persistence_registry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/time_provider_persistence_registry.yml) \| *version*: **2**

docs/_posts/2022-01-27-disable_etw_through_registry.md

@@ -3,7 +3,7 @@ title: "Disable ETW Through Registry"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-06-22
+last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ this search is to identify modification in registry to disable ETW windows featu
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-06-22
+- **Last Updated**: 2022-01-27
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: f0eacfa4-d33f-11eb-8f9d-acde48001122
 
@@ -45,10 +45,15 @@ this search is to identify modification in registry to disable ETW windows featu
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_etw_through_registry_filter`
 ```
 
@@ -93,4 +98,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_etw_through_registry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_etw_through_registry.yml) \| *version*: **2**

docs/_posts/2022-01-27-disable_registry_tool.md

@@ -3,7 +3,7 @@ title: "Disable Registry Tool"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-03-31
+last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This search identifies modification of registry to disable the regedit or regist
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-31
+- **Last Updated**: 2022-01-27
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: cd2cf33c-9201-11eb-a10a-acde48001122
 
@@ -45,10 +45,15 @@ This search identifies modification of registry to disable the regedit or regist
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_registry_tool_filter`
 ```
 
@@ -101,4 +106,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_registry_tool.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_registry_tool.yml) \| *version*: **2**

docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md

@@ -3,7 +3,7 @@ title: "Disable Security Logs Using MiniNt Registry"
 excerpt: "Modify Registry"
 categories:
   - Endpoint
-last_modified_at: 2021-10-05
+last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
@@ -26,7 +26,7 @@ This analytic is to detect a suspicious registry modification to disable securit
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-10-05
+- **Last Updated**: 2022-01-27
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 39ebdc68-25b9-11ec-aec7-acde48001122
 
@@ -41,9 +41,15 @@ This analytic is to detect a suspicious registry modification to disable securit
 
 ```
 
-| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
+| `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_security_logs_using_minint_registry_filter`
 ```
 
@@ -95,4 +101,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_security_logs_using_minint_registry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_security_logs_using_minint_registry.yml) \| *version*: **2**

docs/_posts/2022-01-27-disable_show_hidden_files.md

@@ -3,7 +3,7 @@ title: "Disable Show Hidden Files"
 excerpt: "Hidden Files and Directories, Disable or Modify Tools, Hide Artifacts, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-03-31
+last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
@@ -32,7 +32,7 @@ The following analytic is to identify a modification in the Windows registry to
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-31
+- **Last Updated**: 2022-01-27
 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
 - **ID**: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
 
@@ -53,10 +53,15 @@ The following analytic is to identify a modification in the Windows registry to
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000") by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_show_hidden_files_filter`
 ```
 
@@ -109,4 +114,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_show_hidden_files.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_show_hidden_files.yml) \| *version*: **2**

docs/_posts/2022-01-27-disable_uac_remote_restriction.md

@@ -3,7 +3,7 @@ title: "Disable UAC Remote Restriction"
 excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism"
 categories:
   - Endpoint
-last_modified_at: 2021-09-29
+last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
@@ -30,7 +30,7 @@ This analytic is to detect a suspicious modification of registry to disable UAC
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-09-29
+- **Last Updated**: 2022-01-27
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 9928b732-210e-11ec-b65e-acde48001122
 
@@ -47,10 +47,15 @@ This analytic is to detect a suspicious modification of registry to disable UAC
 
 ```
 
-| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_uac_remote_restriction_filter`
 ```
 
@@ -103,4 +108,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_uac_remote_restriction.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_uac_remote_restriction.yml) \| *version*: **2**

docs/_posts/2022-01-27-disable_windows_app_hotkeys.md

@@ -3,7 +3,7 @@ title: "Disable Windows App Hotkeys"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-05-05
+last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This analytic detects a suspicious registry modification to disable Windows hotk
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-05-05
+- **Last Updated**: 2022-01-27
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 1490f224-ad8b-11eb-8c4f-acde48001122
 
@@ -45,10 +45,15 @@ This analytic detects a suspicious registry modification to disable Windows hotk
 
 ```
 
-| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_name = "HotKey Disabled" AND Registry.registry_key_name = "Debugger" by Registry.dest Registry.user Registry.registry_value_name 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `disable_windows_app_hotkeys_filter`
 ```
 
@@ -98,4 +103,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_windows_app_hotkeys.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_windows_app_hotkeys.yml) \| *version*: **2**

docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md

@@ -3,7 +3,7 @@ title: "Disable Windows Behavior Monitoring"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-03-31
+last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This search is to identifies a modification in registry to disable the windows d
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-31
+- **Last Updated**: 2022-01-27
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 79439cae-9200-11eb-a4d3-acde48001122
 
@@ -45,10 +45,15 @@ This search is to identifies a modification in registry to disable the windows d
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_windows_behavior_monitoring_filter`
 ```
 
@@ -103,4 +108,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_windows_behavior_monitoring.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_windows_behavior_monitoring.yml) \| *version*: **2**

docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md

@@ -3,7 +3,7 @@ title: "Disable Windows SmartScreen Protection"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-03-31
+last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ The following search identifies a modification of registry to disable the smarts
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-31
+- **Last Updated**: 2022-01-27
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 664f0fd0-91ff-11eb-a56f-acde48001122
 
@@ -45,10 +45,15 @@ The following search identifies a modification of registry to disable the smarts
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled"  Registry.registry_value_name = "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled"  Registry.registry_value_data= "Off" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disable_windows_smartscreen_protection_filter`
 ```
 
@@ -101,4 +106,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_windows_smartscreen_protection.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_windows_smartscreen_protection.yml) \| *version*: **2**

docs/_posts/2022-01-27-disabling_cmd_application.md

@@ -3,7 +3,7 @@ title: "Disabling CMD Application"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-03-31
+last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ this search is to identify modification in registry to disable cmd prompt applic
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-31
+- **Last Updated**: 2022-01-27
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: ff86077c-9212-11eb-a1e6-acde48001122
 
@@ -45,10 +45,15 @@ this search is to identify modification in registry to disable cmd prompt applic
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `disabling_cmd_application_filter`
 ```
 
@@ -101,4 +106,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_cmd_application.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_cmd_application.yml) \| *version*: **2**

docs/_posts/2022-01-27-disabling_controlpanel.md

@@ -3,7 +3,7 @@ title: "Disabling ControlPanel"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-03-31
+last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ this search is to identify registry modification to disable control panel window
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-31
+- **Last Updated**: 2022-01-27
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 6ae0148e-9215-11eb-a94a-acde48001122
 
@@ -45,10 +45,15 @@ this search is to identify registry modification to disable control panel window
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `disabling_controlpanel_filter`
 ```
 
@@ -101,4 +106,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_controlpanel.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_controlpanel.yml) \| *version*: **2**

docs/_posts/2022-01-27-windows_possible_credential_dumping.md

@@ -3,7 +3,7 @@ title: "Windows Possible Credential Dumping"
 excerpt: "LSASS Memory, OS Credential Dumping"
 categories:
   - Endpoint
-last_modified_at: 2022-01-10
+last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
@@ -31,7 +31,7 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
-- **Last Updated**: 2022-01-10
+- **Last Updated**: 2022-01-27
 - **Author**: Michael Haag, Splunk
 - **ID**: e4723b92-7266-11ec-af45-acde48001122
 
@@ -47,7 +47,7 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
 #### Search
 
 ```
-`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x1438", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") 
+`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") 
 | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser 
 | rename Computer as dest 
 | `security_content_ctime(firstTime)`
@@ -80,7 +80,7 @@ To successfully implement this search, you need to be ingesting logs with the pr
 
 
 #### Known False Positives
-False positives will occur based on GrantedAccess, filter based on source image as needed.
+False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught.
 
 
 #### RBA
@@ -110,4 +110,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_possible_credential_dumping.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_possible_credential_dumping.yml) \| *version*: **2**

docs/_posts/2022-01-28-disabling_defender_services.md

@@ -3,7 +3,7 @@ title: "Disabling Defender Services"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-10-20
+last_modified_at: 2022-01-28
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This particular behavior is typically executed when an adversaries or malware ga
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-10-20
+- **Last Updated**: 2022-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 911eacdc-317f-11ec-ad30-acde48001122
 
@@ -45,10 +45,15 @@ This particular behavior is typically executed when an adversaries or malware ga
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*", "*WinDefend*", "*SecurityHealthService*"))  AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*")) AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `disabling_defender_services_filter`
 ```
 
@@ -100,4 +105,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_defender_services.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_defender_services.yml) \| *version*: **2**

docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md

@@ -3,7 +3,7 @@ title: "Disabling FolderOptions Windows Feature"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-03-31
+last_modified_at: 2022-01-28
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This search is to identify registry modification to disable folder options featu
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-31
+- **Last Updated**: 2022-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 83776de4-921a-11eb-868a-acde48001122
 
@@ -45,10 +45,15 @@ This search is to identify registry modification to disable folder options featu
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `disabling_folderoptions_windows_feature_filter`
 ```
 
@@ -101,4 +106,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml) \| *version*: **2**

docs/_posts/2022-01-28-disabling_norun_windows_app.md

@@ -3,7 +3,7 @@ title: "Disabling NoRun Windows App"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-03-31
+last_modified_at: 2022-01-28
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This search is to identify modification of registry to disable run application i
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-31
+- **Last Updated**: 2022-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: de81bc46-9213-11eb-adc9-acde48001122
 
@@ -45,10 +45,15 @@ This search is to identify modification of registry to disable run application i
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `disabling_norun_windows_app_filter`
 ```
 
@@ -102,4 +107,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_norun_windows_app.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_norun_windows_app.yml) \| *version*: **2**

docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md

@@ -3,7 +3,7 @@ title: "Disabling SystemRestore In Registry"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
   - Endpoint
-last_modified_at: 2021-03-31
+last_modified_at: 2022-01-28
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ The following search identifies the modification of registry related in disablin
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-31
+- **Last Updated**: 2022-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: f4f837e2-91fb-11eb-8bf6-acde48001122
 
@@ -45,10 +45,15 @@ The following search identifies the modification of registry related in disablin
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `disabling_systemrestore_in_registry_filter`
 ```
 
@@ -101,4 +106,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_systemrestore_in_registry.yml) \| *version*: **1**
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabling_systemrestore_in_registry.yml) \| *version*: **2**