Delete ssa___deny_permission_using_cacls_utility.yml

detections/endpoint/ssa___deny_permission_using_cacls_utility.yml

@@ -1,49 +0,0 @@
-name: Deny Permission using Cacls Utility
-id: b76eae28-cd25-11eb-9c92-acde48001122
-version: 1
-date: '2021-06-14'
-author: Teoderick Contreras, Splunk
-type: streaming
-datamodel:
-- Endpoint
-description: This analytic identifies a potential adversary that changes the security
-  permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection and prevent
-  access to their component files.
-search: '| from read_ssa_enriched_events() 
-  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), 
-  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), 
-  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
-  | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true 
-  AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") 
-  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), 
-  ucast(map_get(input_event, "dest_device_id"), "string", null)), 
-  body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
-  | into write_ssa_detected_events();'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
-known_false_positives: network administrator may use this windows utility but this is not a common practice.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-tags:
-  analytic_story:
-  - XMRig
-  kill_chain_phases:
-  - Exploitation
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
-  mitre_attack_id:
-  - T1222
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  security_domain: endpoint