From e9484c657fb5562e47d1690ab7d63693ae744230 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 30 Aug 2022 06:31:00 -0600
Subject: [PATCH 01/27] Update
 ssa___windows_lolbin_binary_in_non_standard_path.yml

---
 .../ssa___windows_lolbin_binary_in_non_standard_path.yml    | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 3c745c91b3..e60a9df909 100644
--- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -1,6 +1,6 @@
 name: Windows LOLBin Binary in Non Standard Path
 id: 25689101-012a-324a-94d3-08301e6c065a
-version: 3
+version: 4
 description: The following analytic identifies native living off the land binaries
   within the Windows operating system that may be abused by adversaries by moving
   it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io
@@ -14,7 +14,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
   $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe"
-  OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe"
+  OR process_name="at.exe" OR process_name="atbroker.exe"
   OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe"
   OR process_name="certutil.exe" OR process_name="cmdkey.exe" OR process_name="cmdl32.exe"
   OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe"
@@ -30,7 +30,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe"
   OR process_name="msdt.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
   OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe"
-  OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR
+  OR process_name="pcalua.exe" OR
   process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe"
   OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe"
   OR process_name="psr.exe" OR process_name="rasautou.exe" OR process_name="reg.exe"

From 44bc5ac3daeff0dfc7a0048ea5090c7dee7d1379 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 30 Aug 2022 06:38:55 -0600
Subject: [PATCH 02/27] Update windows_ingress_tool_transfer_using_explorer.yml

---
 ...s_ingress_tool_transfer_using_explorer.yml | 32 +++++++++++++------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
index 7866b9324f..8b8526b547 100644
--- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
+++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
@@ -1,16 +1,16 @@
 name: Windows Ingress Tool Transfer Using Explorer
 id: 76753bab-f116-4ea3-8fb9-89b638be58a9
-version: 1
-date: '2022-08-01'
+version: 2
+date: '2022-08-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic detects an explorer.exe with a possible url link process command line on it.
-  Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. 
-  So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application 
-  in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
-  which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link.
+description: The following analytic identifies the Windows Explorer process with a URL within the command-line.
+  Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. 
+  Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application 
+  on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
+  which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where (Processes.process_name = explorer.exe OR Processes.original_file_name = explorer.exe) AND NOT (Processes.parent_process_name IN("userinit.exe", "svchost.exe")) Processes.process IN ("* http://*", "* https://*")
   by  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id Processes.dest Processes.user
@@ -23,7 +23,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: unknown
+known_false_positives: False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names. 
 references:
 - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
 tags:
@@ -43,16 +43,28 @@ tags:
   impact: 50
   kill_chain_phases:
   - Exploitation
-  message: a explorer process with url link $process$ in $dest$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote payload.
   mitre_attack_id:
   - T1105
   nist:
   - DE.CM
   observable:
+  - name: user
+    type: User
+    role:
+    - Victim
   - name: dest
     type: Hostname
     role:
     - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -71,4 +83,4 @@ tags:
   - Processes.process_path
   - Processes.parent_process_id
   risk_score: 25
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file

From affae7229d165131a993083c8b9fb1a723a295b8 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 1 Sep 2022 15:02:44 -0600
Subject: [PATCH 03/27] SSA all things

---
 .../endpoint/dump_lsass_via_procdump.yml      |  5 +-
 ...ows_lolbin_binary_in_non_standard_path.yml |  8 +-
 ...tial_dumping_with_ntdsutil_export_ntds.yml | 90 +++++++++++++++++++
 ...ws_os_credential_dumping_with_procdump.yml | 87 ++++++++++++++++++
 ...xy_execution_msiexec_dllregisterserver.yml | 78 ++++++++++++++++
 ...roxy_execution_msiexec_remote_download.yml | 78 ++++++++++++++++
 ...proxy_execution_msiexec_unregister_dll.yml | 78 ++++++++++++++++
 ...execution_compiled_html_file_decompile.yml | 79 ++++++++++++++++
 ...dumping_with_ntdsutil_export_ntds.test.yml |  9 ++
 ..._credential_dumping_with_procdump.test.yml |  9 ++
 ...ecution_msiexec_dllregisterserver.test.yml |  9 ++
 ...execution_msiexec_remote_download.test.yml |  9 ++
 ..._execution_msiexec_unregister_dll.test.yml |  9 ++
 ...tion_compiled_html_file_decompile.test.yml | 13 +++
 14 files changed, 555 insertions(+), 6 deletions(-)
 create mode 100644 detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
 create mode 100644 detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
 create mode 100644 detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
 create mode 100644 tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
 create mode 100644 tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
 create mode 100644 tests/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml

diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 42f12b5b6e..4c00cb3b3d 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -1,7 +1,7 @@
 name: Dump LSASS via procdump
 id: 3742ebfe-64c2-11eb-ae93-0242ac130002
-version: 2
-date: '2021-09-16'
+version: 3
+date: '2022-08-31'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -31,6 +31,7 @@ references:
 - https://attack.mitre.org/techniques/T1003/001/
 - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
 tags:
   analytic_story:
   - Credential Dumping
diff --git a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 15ebfb6e05..0d1be4f702 100644
--- a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -1,7 +1,7 @@
 name: Windows LOLBin Binary in Non Standard Path
 id: 25689101-012a-324a-94d3-08301e6c065a
-version: 3
-date: '2022-07-19'
+version: 4
+date: '2022-08-31'
 author: Michael Haag, Splunk
 type: Anomaly
 datamodel:
@@ -16,11 +16,11 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
-  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
+  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
   process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
   process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
   process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
-  process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
+  process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
   process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
   process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
 
diff --git a/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
new file mode 100644
index 0000000000..e42761953e
--- /dev/null
+++ b/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
@@ -0,0 +1,90 @@
+name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+id: f111cdc1-43ee-4429-a3c0-qpce4fed7a85
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
+  database - NTDS.dit, typically used for offline password cracking. It may be used
+  in normal circumstances with no command line arguments or shorthand variations of
+  more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
+  command used to dump ntds.dit \
+
+  ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
+
+  This technique uses "Install from Media" (IFM), which will extract a copy of the
+  Active Directory database. A successful export of the Active Directory database
+  will yield a file modification named ntds.dit to the destination.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="ntdsutil.exe"
+  AND (like (cmd_line, "%ntds%") AND like (cmd_line, "%create%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: Highly possible Server Administrators will troubleshoot with
+  ntdsutil.exe, generating false positives.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  - Living Off The Land
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: Active Directory NTDS export on $dest_device_id$ using $process_name$ by $dest_user_id$.
+  mitre_attack_id:
+  - T1003.003
+  - T1003
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 50
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
new file mode 100644
index 0000000000..39ae0a2f14
--- /dev/null
+++ b/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
@@ -0,0 +1,87 @@
+name: Windows OS Credential Dumping with Procdump
+id: f111cdc1-43ee-3921-a3z0-fx9ce4fed7a85
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: 'Detect procdump.exe dumping the lsass process. This query looks for
+  both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
+  file with all process memory. Both are highly suspect and should be reviewed. This
+  query does not monitor for the internal name (original_file_name=procdump) of the
+  PE or look for procdump64.exe. Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on
+  the command line. Review other endpoint data sources for cross process (injection)
+  into lsass.exe.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND (process_name="procdump.exe" OR process_name="procdump64.exe")
+  AND (like (cmd_line, "%-mm %") OR like (cmd_line, "%-ma %")) AND like (cmd_line, "%lsass%") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: None identified.
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  cis20: []
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: Procdump was utilized to dump lsass on $dest_device_id$ by $dest_user_id$.
+  mitre_attack_id:
+  - T1003.001
+  - T1003
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
new file mode 100644
index 0000000000..3123fe983c
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
@@ -0,0 +1,78 @@
+name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+id: f111cdc1-43ee-4429-z3c0-ffce4fed7xc5
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the usage of msiexec.exe using the
+  /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/y %") OR like (cmd_line, "%-y %")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: This analytic will need to be tuned for your environment based
+  on legitimate usage of msiexec.exe. Filter as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to register a file.
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
new file mode 100644
index 0000000000..97a8fcc230
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
@@ -0,0 +1,78 @@
+name: Windows System Binary Proxy Execution MSIExec Remote Download
+id: f111cdc1-z3ee-4429-a3c0-ffzse4fed7a85
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies msiexec.exe with http in the command-line.
+  This procedure will utilize msiexec.exe to download a remote file and load it. During
+  triage, review parallel processes and capture any artifacts on disk for review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
new file mode 100644
index 0000000000..3052faed21
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
@@ -0,0 +1,78 @@
+name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+id: f111cdc1-43cp-4429-a3c0-ffcx4fed7a85
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description:  The following analytic identifies the usage of msiexec.exe using the
+  /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/z %") OR like (cmd_line, "%-z %")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to unregister a DLL.
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
new file mode 100644
index 0000000000..46c2483c02
--- /dev/null
+++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -0,0 +1,79 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_hh`
+  Processes.process=*-decompile* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_system_binary_proxy_execution_compiled_html_file_decompile_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives should be limited, filter as needed.
+references:
+  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
+  - https://redcanary.com/blog/introducing-atomictestharnesses/
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Delivery
+  message:  $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$.
+  mitre_attack_id:
+  - T1218.001
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 90
+  security_domain: endpoint
diff --git a/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml b/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
new file mode 100644
index 0000000000..19e31e71ea
--- /dev/null
+++ b/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
@@ -0,0 +1,9 @@
+name: Windows OS Credential Dumping with Ntdsutil Export NTDS Unit Test
+tests:
+- name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+  file: endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml b/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
new file mode 100644
index 0000000000..7b61656534
--- /dev/null
+++ b/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
@@ -0,0 +1,9 @@
+name: Windows OS Credential Dumping with Procdump Unit Test
+tests:
+- name: Windows OS Credential Dumping with Procdump
+  file: endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: procdump_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
new file mode 100644
index 0000000000..484fba41b2
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer Unit Test
+tests:
+- name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+  file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_msiexec-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
new file mode 100644
index 0000000000..c84e6686b6
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution MSIExec Remote Download Unit Test
+tests:
+- name: Windows System Binary Proxy Execution MSIExec Remote Download
+  file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_msiexec-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
new file mode 100644
index 0000000000..3ced45f3a0
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution MSIExec Unregister DLL Unit Test
+tests:
+- name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+  file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_msiexec-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml b/tests/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
new file mode 100644
index 0000000000..a390c10984
--- /dev/null
+++ b/tests/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
@@ -0,0 +1,13 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+  file: endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: hh_decom_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 171f7e2b801c1cdaa7bcdb6f1c70f2425613330a Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 1 Sep 2022 15:10:29 -0600
Subject: [PATCH 04/27] id fix

---
 ..._windows_os_credential_dumping_with_ntdsutil_export_ntds.yml | 2 +-
 .../ssa___windows_os_credential_dumping_with_procdump.yml       | 2 +-
 ..._system_binary_proxy_execution_msiexec_dllregisterserver.yml | 2 +-
 ...ws_system_binary_proxy_execution_msiexec_remote_download.yml | 2 +-
 ...ows_system_binary_proxy_execution_msiexec_unregister_dll.yml | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
index e42761953e..40fc576c6e 100644
--- a/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+++ b/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
@@ -1,5 +1,5 @@
 name: Windows OS Credential Dumping with Ntdsutil Export NTDS
-id: f111cdc1-43ee-4429-a3c0-qpce4fed7a85
+id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e
 version: 1
 date: '2022-08-31'
 author: Michael Haag, Splunk
diff --git a/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
index 39ae0a2f14..950bad3447 100644
--- a/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+++ b/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
@@ -1,5 +1,5 @@
 name: Windows OS Credential Dumping with Procdump
-id: f111cdc1-43ee-3921-a3z0-fx9ce4fed7a85
+id: e102e297-dbe6-4a19-b319-5c08f4c19a06
 version: 1
 date: '2022-08-31'
 author: Michael Haag, Splunk
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
index 3123fe983c..5f60b75dfa 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
@@ -1,5 +1,5 @@
 name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
-id: f111cdc1-43ee-4429-z3c0-ffce4fed7xc5
+id: 8d1d5570-722c-49a3-996c-2e2cceef5163
 version: 1
 date: '2022-08-31'
 author: Michael Haag, Splunk
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
index 97a8fcc230..d8d6547ffc 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
@@ -1,5 +1,5 @@
 name: Windows System Binary Proxy Execution MSIExec Remote Download
-id: f111cdc1-z3ee-4429-a3c0-ffzse4fed7a85
+id: 92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5
 version: 1
 date: '2022-08-31'
 author: Michael Haag, Splunk
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
index 3052faed21..8a6a38d13e 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
@@ -1,5 +1,5 @@
 name: Windows System Binary Proxy Execution MSIExec Unregister DLL
-id: f111cdc1-43cp-4429-a3c0-ffcx4fed7a85
+id: df76a8d1-92e1-4ec9-b8f7-695b5838703e
 version: 1
 date: '2022-08-31'
 author: Michael Haag, Splunk

From 6287645f489845bc53e621fca844f66892c9bc10 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 2 Sep 2022 14:44:39 -0600
Subject: [PATCH 05/27] BA

---
 ...execution_compiled_html_file_decompile.yml | 82 ++++++++++++++++
 ...compiled_html_file_url_in_command_line.yml | 94 ++++++++++++++++++
 ...l_file_using_infotech_storage_handlers.yml | 96 +++++++++++++++++++
 ...execution_compiled_html_file_decompile.yml |  3 +-
 ...tion_compiled_html_file_decompile.test.yml |  9 ++
 ...led_html_file_url_in_command_line.test.yml |  9 ++
 ...e_using_infotech_storage_handlers.test.yml |  9 ++
 7 files changed, 301 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml

diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
new file mode 100644
index 0000000000..3f41e40fdc
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -0,0 +1,82 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+id: 11c32b19-05a6-48a8-ab28-18dbd9ec5d50
+version: 1
+date: '2022-09-02'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe"
+  AND like (cmd_line, "%-decompile%")| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives should be limited, filter as needed.
+references:
+  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
+  - https://redcanary.com/blog/introducing-atomictestharnesses/
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ has been identified using decompile against a CHM on $dest_device_id$ under user $dest_user_id$.
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
new file mode 100644
index 0000000000..7170164ac1
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
@@ -0,0 +1,94 @@
+name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+id: 0fec631a-7c9b-4e4c-b28b-93260953e25f
+version: 1
+date: '2022-09-02'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file from a remote url. This particular technique will load Windows
+  script code from a compiled help file. CHM files may  contain nearly any file type
+  embedded, but only execute html/htm. Upon a successful execution, the following
+  script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode,
+  JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe
+  upon execution. The "htm" and "html" file extensions were the only extensions observed
+  to be supported for the execution of Shortcut commands or WSH script code. During
+  investigation, identify script content origination. Review reputation of remote
+  IP and domain. Some instances, it is worth decompiling the .chm file to review its
+  original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives:  Although unlikely, some legitimate applications may retrieve
+  a CHM remotely, filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://www.kb.cert.org/vuls/id/851869
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+  - https://lolbas-project.github.io/lolbas/Binaries/Hh/
+  - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+  - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ contacting a remote destination.
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
new file mode 100644
index 0000000000..c0a90aeb79
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
@@ -0,0 +1,96 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers
+id: ba0c2450-caea-4086-ac3a-a71e2659754b
+version: 1
+date: '2022-09-02'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
+  will load Windows script code from a compiled help file, using InfoTech Storage
+  Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are
+  supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm
+  file from within a CHM file. CHM files may contain nearly any file type embedded.
+  Upon a successful execution, the following script engines may be used for execution
+  - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may
+  identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm"
+  and "html" file extensions were the only extensions observed to be supported for
+  the execution of Shortcut commands or WSH script code. During investigation, identify
+  script content origination. hh.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe"
+  AND (like (cmd_line, "%its:%") OR like (cmd_line, "%-y %"))| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
+  used, but it does happen in some legitimate instances. Filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://www.kb.cert.org/vuls/id/851869
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+  - https://lolbas-project.github.io/lolbas/Binaries/Hh/
+  - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+  - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ has been identified using Infotech Storage Handlers to load
+    a specific file within a CHM on $dest_device_id$ under user $dest_user_id$.
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 72
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
index 46c2483c02..ef44ccfb51 100644
--- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -40,9 +40,10 @@ tags:
   impact: 100
   kill_chain_phases:
   - Delivery
-  message:  $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$.
+  message: $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$.
   mitre_attack_id:
   - T1218.001
+  - T1218
   nist:
   - DE.CM
   observable:
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
new file mode 100644
index 0000000000..d5901517a6
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+  file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
new file mode 100644
index 0000000000..f52f91bf5e
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+  file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_url_in_command_line.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
new file mode 100644
index 0000000000..5965ef46ed
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers
+  file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_using_infotech_storage_handlers.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file

From f0601e4f9d0124c9682a1528e71e72e90606b2f5 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 2 Sep 2022 15:04:47 -0600
Subject: [PATCH 06/27] Update
 ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml

---
 ...stem_binary_proxy_execution_compiled_html_file_decompile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
index 3f41e40fdc..5ce482a836 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -77,6 +77,6 @@ tags:
   - dest_user_id
   - process
   - cmd_line
-  risk_score: 80
+  risk_score: 90
   security_domain: endpoint
   asset_type: Endpoint

From 6ea742801105dc6c1d6b7e301064ce2662cd6b4d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 8 Sep 2022 10:23:08 -0600
Subject: [PATCH 07/27] test test

---
 ...s_os_credential_dumping_with_ntdsutil_export_ntds.test.yml | 4 +++-
 ...ssa___windows_os_credential_dumping_with_procdump.test.yml | 4 +++-
 ...nary_proxy_execution_compiled_html_file_decompile.test.yml | 4 +++-
 ..._execution_compiled_html_file_url_in_command_line.test.yml | 2 +-
 4 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml b/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
index 19e31e71ea..2a80b82852 100644
--- a/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
+++ b/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml b/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
index 7b61656534..f4e4fb3bc8 100644
--- a/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
+++ b/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: procdump_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
index d5901517a6..910f26b248 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
index f52f91bf5e..66d703c44f 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
@@ -6,4 +6,4 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: xmlwineventLog:security
\ No newline at end of file

From 1c928ebffe3fad2311c8ecb915a1b46ea4f2a708 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 8 Sep 2022 10:27:54 -0600
Subject: [PATCH 08/27] fixord

---
 ...ompiled_html_file_using_infotech_storage_handlers.test.yml | 4 +++-
 ..._binary_proxy_execution_msiexec_dllregisterserver.test.yml | 4 +++-
 ...em_binary_proxy_execution_msiexec_remote_download.test.yml | 4 +++-
 ...tem_binary_proxy_execution_msiexec_unregister_dll.test.yml | 4 +++-
 4 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
index 5965ef46ed..affc26c0a0 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
index 484fba41b2..0d1e393cec 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_msiexec-windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
index c84e6686b6..322571edfe 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_msiexec-windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
index 3ced45f3a0..cee7bc84e1 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_msiexec-windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file

From 6531d4350ec85d2207a86b49d8c8b9452c9bb748 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 8 Sep 2022 10:34:08 -0600
Subject: [PATCH 09/27] Update
 ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml

---
 ..._execution_compiled_html_file_url_in_command_line.test.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
index 66d703c44f..9efcc203e0 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: xmlwineventLog:security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file

From 442955c826fd6474b0b41a803f41abf6019c910e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 8 Sep 2022 10:48:20 -0600
Subject: [PATCH 10/27] chm fixes

---
 ...xy_execution_compiled_html_file_url_in_command_line.yml | 2 +-
 ..._compiled_html_file_using_infotech_storage_handlers.yml | 4 ++--
 ...ecution_compiled_html_file_url_in_command_line.test.yml | 7 +++----
 ...iled_html_file_using_infotech_storage_handlers.test.yml | 7 +++----
 4 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
index 7170164ac1..a088ee9522 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
@@ -53,7 +53,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
   impact: 90
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
index c0a90aeb79..f77c4fbcdc 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
@@ -26,7 +26,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe"
-  AND (like (cmd_line, "%its:%") OR like (cmd_line, "%-y %"))| eval start_time=timestamp, end_time=timestamp,
+  AND (like (cmd_line, "%its:%") OR like (cmd_line, "%mk:@MSITStore:%"))| eval start_time=timestamp, end_time=timestamp,
   entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
   "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
   cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
@@ -55,7 +55,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
   impact: 80
   kill_chain_phases:
   - Exploitation
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
index 9efcc203e0..47a7566587 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
@@ -4,8 +4,7 @@ tests:
   file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_url_in_command_line.yml
   pass_condition: '@count_gt(0)'
   attack_data:
-  - file_name: 4688_windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog
-    sourcetype: XmlWinEventLog
+  - file_name: chm-wineventlog-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+    source: WinEventLog:Security
     update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
index affc26c0a0..9850d4e8b2 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
@@ -4,8 +4,7 @@ tests:
   file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_using_infotech_storage_handlers.yml
   pass_condition: '@count_gt(0)'
   attack_data:
-  - file_name: 4688_windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog
-    sourcetype: XmlWinEventLog
+  - file_name: chm-wineventlog-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+    source: WinEventLog:Security
     update_timestamp: true
\ No newline at end of file

From f0324892d5fefa621476f5ce4dcef0e4f3b4a6dd Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 9 Sep 2022 06:50:43 -0600
Subject: [PATCH 11/27] hunt Windows Event Triggered Image File Execution
 Options Injection

---
 ...image_file_execution_options_injection.yml | 61 +++++++++++++++++++
 macros/wineventlog_application.yml            |  4 ++
 ..._file_execution_options_injection.test.yml | 13 ++++
 3 files changed, 78 insertions(+)
 create mode 100644 detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
 create mode 100644 macros/wineventlog_application.yml
 create mode 100644 tests/endpoint/windows_event_triggered_image_file_execution_options_injection.test.yml

diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
new file mode 100644
index 0000000000..a1bbb9177e
--- /dev/null
+++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
@@ -0,0 +1,61 @@
+name: Windows Event Triggered Image File Execution Options Injection
+id: f7abfab9-12ea-44e8-8745-475f9ca6e0a4
+version: 1
+date: '2022-09-08'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. 
+  The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior.
+  Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.
+search: '`wineventlog_application` EventCode=3000 
+| rename param1 AS "Process" param2 AS "Exit_Code"
+| stats count min(_time) as firstTime max(_time) as lastTime by Process Exit_Code dest
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `windows_event_triggered_image_file_execution_options_injection_filter`'
+how_to_implement: This analytic requires capturing the Windows Event Log Application channel in XML. 
+known_false_positives: False positives may be present and tuning will be required before turning into a TTP or notable.
+references:
+- https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offense.html
+- https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-application.log
+  impact: 50
+  kill_chain_phases:
+  - Installation
+  message: Windows eventcode 3000 triggered on $dest$ potentially indicating persistence or a monitoring of a process has occurred.
+  mitre_attack_id:
+  - T1546.012
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Process 
+  - Exit_Code 
+  - dest
+  - EventCode
+  risk_score: 25
+  security_domain: endpoint
diff --git a/macros/wineventlog_application.yml b/macros/wineventlog_application.yml
new file mode 100644
index 0000000000..a3a889062e
--- /dev/null
+++ b/macros/wineventlog_application.yml
@@ -0,0 +1,4 @@
+definition: eventtype=wineventlog_application
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: wineventlog_application
diff --git a/tests/endpoint/windows_event_triggered_image_file_execution_options_injection.test.yml b/tests/endpoint/windows_event_triggered_image_file_execution_options_injection.test.yml
new file mode 100644
index 0000000000..0631360604
--- /dev/null
+++ b/tests/endpoint/windows_event_triggered_image_file_execution_options_injection.test.yml
@@ -0,0 +1,13 @@
+name: Windows Event Triggered Image File Execution Options Injection Unit Test
+tests:
+- name: Windows Event Triggered Image File Execution Options Injection
+  file: endpoint/windows_event_triggered_image_file_execution_options_injection.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-application.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-application.log
+    source: XmlWinEventLog:Application
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

From c3653c14043a2a441ecc101ed2ede95f68229fef Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 12 Sep 2022 07:57:53 -0600
Subject: [PATCH 12/27] test

---
 ...s_event_triggered_image_file_execution_options_injection.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
index a1bbb9177e..38f54490fb 100644
--- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
+++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
@@ -9,7 +9,7 @@ datamodel:
 description: The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. 
   The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior.
   Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.
-search: '`wineventlog_application` EventCode=3000 
+search: 'source="XmlWinEventLog:Application" EventCode=3000 
 | rename param1 AS "Process" param2 AS "Exit_Code"
 | stats count min(_time) as firstTime max(_time) as lastTime by Process Exit_Code dest
 | `security_content_ctime(firstTime)` 

From 00a2a9596181329e194547f269419558bccc90ab Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 12 Sep 2022 08:18:30 -0600
Subject: [PATCH 13/27] space or tab, we'll never know

---
 ...ggered_image_file_execution_options_injection.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
index 38f54490fb..c09fc6be0d 100644
--- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
+++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
@@ -9,12 +9,12 @@ datamodel:
 description: The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. 
   The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior.
   Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.
-search: 'source="XmlWinEventLog:Application" EventCode=3000 
-| rename param1 AS "Process" param2 AS "Exit_Code"
-| stats count min(_time) as firstTime max(_time) as lastTime by Process Exit_Code dest
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)`
-| `windows_event_triggered_image_file_execution_options_injection_filter`'
+search: '`wineventlog_application` EventCode=3000 
+  | rename param1 AS "Process" param2 AS "Exit_Code"
+  | stats count min(_time) as firstTime max(_time) as lastTime by Process Exit_Code dest
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_event_triggered_image_file_execution_options_injection_filter`'
 how_to_implement: This analytic requires capturing the Windows Event Log Application channel in XML. 
 known_false_positives: False positives may be present and tuning will be required before turning into a TTP or notable.
 references:

From 7507b45e78f89e881eb1656783440f54bb1cd003 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 12 Sep 2022 08:44:58 -0600
Subject: [PATCH 14/27] Update
 windows_event_triggered_image_file_execution_options_injection.yml

---
 ..._event_triggered_image_file_execution_options_injection.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
index c09fc6be0d..0e3deecdc2 100644
--- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
+++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2022-09-08'
 author: Michael Haag, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. 
   The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior.
   Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.

From 36ffb11950d12ee072e752fedd826f5d162ef0c8 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 12 Sep 2022 08:53:24 -0600
Subject: [PATCH 15/27] Update wineventlog_application.yml

---
 macros/wineventlog_application.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/macros/wineventlog_application.yml b/macros/wineventlog_application.yml
index a3a889062e..e3e98c58c7 100644
--- a/macros/wineventlog_application.yml
+++ b/macros/wineventlog_application.yml
@@ -1,4 +1,4 @@
-definition: eventtype=wineventlog_application
+definition: eventtype=wineventlog_application OR source="XmlWinEventLog:Application"
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
-name: wineventlog_application
+name: wineventlog_application
\ No newline at end of file

From fb15ba799aca24ce1ed954af8be21660e18e574b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 13 Sep 2022 10:48:22 -0600
Subject: [PATCH 16/27] Update windows_identify_protocol_handlers.yml

---
 detections/endpoint/windows_identify_protocol_handlers.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml
index a0042656bc..13e5fe4474 100644
--- a/detections/endpoint/windows_identify_protocol_handlers.yml
+++ b/detections/endpoint/windows_identify_protocol_handlers.yml
@@ -1,13 +1,13 @@
 name: Windows Identify Protocol Handlers
 id: bd5c311e-a6ea-48ae-a289-19a3398e3648
-version: 1
-date: '2022-07-11'
+version: 2
+date: '2022-09-13'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
 - Endpoint
 description: 'The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings).
-  To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.'
+  To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes  by Processes.dest Processes.user Processes.process_name Processes.process 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
@@ -17,6 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
 references:
+  - https://gist.github.com/MHaggis/a0d3edb57d36e0916c94c0a464b2722e
   - https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html
   - https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/
   - https://github.com/Mr-Un1k0d3r/PoisonHandler

From 2fa429127b0cea5e4abb321921353ac741f03b3d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 10:07:38 -0600
Subject: [PATCH 17/27] CISA AA22-257A tag

---
 .../dump_lsass_via_procdump_rename.yml        |  1 +
 ...ate_local_admin_accounts_using_net_exe.yml |  1 +
 .../creation_of_lsass_dump_with_taskmgr.yml   |  1 +
 .../endpoint/detect_exchange_web_shell.yml    |  1 +
 .../detect_mimikatz_using_loaded_images.yml   |  1 +
 .../detect_new_local_admin_account.yml        |  1 +
 .../endpoint/dump_lsass_via_comsvcs_dll.yml   |  1 +
 .../endpoint/dump_lsass_via_procdump.yml      |  1 +
 .../endpoint/extraction_of_registry_hives.yml |  1 +
 ...eduled_task_deleted_or_created_via_cmd.yml |  1 +
 .../endpoint/schtasks_run_task_on_demand.yml  |  1 +
 .../endpoint/short_lived_scheduled_task.yml   |  1 +
 detections/endpoint/w3wp_spawning_shell.yml   |  1 +
 .../windows_hidden_schedule_task_settings.yml |  1 +
 .../windows_possible_credential_dumping.yml   |  1 +
 ..._scheduled_task_created_to_spawn_shell.yml |  1 +
 ...eduled_task_created_within_public_path.yml |  1 +
 ...ws_task_scheduler_event_action_started.yml |  1 +
 ...randomly_generated_scheduled_task_name.yml |  1 +
 ...g4shell_jndi_payload_injection_attempt.yml |  1 +
 stories/cisa_aa22_257a.yml                    | 25 +++++++++++++++++++
 21 files changed, 45 insertions(+)
 create mode 100644 stories/cisa_aa22_257a.yml

diff --git a/detections/deprecated/dump_lsass_via_procdump_rename.yml b/detections/deprecated/dump_lsass_via_procdump_rename.yml
index efc9b72471..33d6deb514 100644
--- a/detections/deprecated/dump_lsass_via_procdump_rename.yml
+++ b/detections/deprecated/dump_lsass_via_procdump_rename.yml
@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Credential Dumping
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index 42a9b1a862..f7d2a8d1fd 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - DHS Report TA18-074A
   - Azorult
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 8
diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
index 15df5f062f..7697ca97a5 100644
--- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
+++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 6
diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml
index 104bd72ffd..119515b9bd 100644
--- a/detections/endpoint/detect_exchange_web_shell.yml
+++ b/detections/endpoint/detect_exchange_web_shell.yml
@@ -51,6 +51,7 @@ tags:
   analytic_story:
   - HAFNIUM Group
   - ProxyShell
+  - CISA AA22-257A
   confidence: 90
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml
index ae5cc07725..94612a9d97 100644
--- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml
+++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml
@@ -30,6 +30,7 @@ tags:
   - Detect Zerologon Attack
   - Cloud Federated Credential Abuse
   - DarkSide Ransomware
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 6
diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml
index 6fd9b5685a..38fb529965 100644
--- a/detections/endpoint/detect_new_local_admin_account.yml
+++ b/detections/endpoint/detect_new_local_admin_account.yml
@@ -22,6 +22,7 @@ tags:
   analytic_story:
   - DHS Report TA18-074A
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 16
diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
index fcb38967de..f9668aa825 100644
--- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
+++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
@@ -28,6 +28,7 @@ tags:
   - HAFNIUM Group
   - Living Off The Land
   - Industroyer2
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 4c00cb3b3d..65fbe9114e 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - Credential Dumping
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml
index 9c32749838..94d8d37474 100644
--- a/detections/endpoint/extraction_of_registry_hives.yml
+++ b/detections/endpoint/extraction_of_registry_hives.yml
@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - DarkSide Ransomware
   - Credential Dumping
+  - CISA AA22-257A
   confidence: 70
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
index 4ef0b987f3..fbf982672e 100644
--- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
@@ -33,6 +33,7 @@ tags:
   - Living Off The Land
   - Azorult
   - DarkCrystal RAT
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml
index f846173778..ed33560e2e 100644
--- a/detections/endpoint/schtasks_run_task_on_demand.yml
+++ b/detections/endpoint/schtasks_run_task_on_demand.yml
@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - XMRig
   - Industroyer2
+  - CISA AA22-257A
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml
index 4ac14b69ff..a67b39894a 100644
--- a/detections/endpoint/short_lived_scheduled_task.yml
+++ b/detections/endpoint/short_lived_scheduled_task.yml
@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - CISA AA22-257A
   confidence: 90
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml
index 488789d381..76f464f205 100644
--- a/detections/endpoint/w3wp_spawning_shell.yml
+++ b/detections/endpoint/w3wp_spawning_shell.yml
@@ -38,6 +38,7 @@ tags:
   - Hermetic Wiper
   - HAFNIUM Group
   - ProxyShell
+  - CISA AA22-257A
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/windows_hidden_schedule_task_settings.yml b/detections/endpoint/windows_hidden_schedule_task_settings.yml
index 2e55b57627..a5465c156e 100644
--- a/detections/endpoint/windows_hidden_schedule_task_settings.yml
+++ b/detections/endpoint/windows_hidden_schedule_task_settings.yml
@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Industroyer2
   - Active Directory Discovery
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml
index f3cd362cc9..d0bc444de2 100644
--- a/detections/endpoint/windows_possible_credential_dumping.yml
+++ b/detections/endpoint/windows_possible_credential_dumping.yml
@@ -44,6 +44,7 @@ tags:
   - Credential Dumping
   - Detect Zerologon Attack
   - DarkSide Ransomware
+  - CISA AA22-257A
   automated_detection_testing: passed
   confidence: 80
   context:
diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
index ea36328a45..82fc6cf309 100644
--- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
@@ -46,6 +46,7 @@ tags:
   - Windows Persistence Techniques
   - Ransomware
   - Ryuk Ransomware
+  - CISA AA22-257A
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index 5f063fbc8e..cc4957c93b 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -49,6 +49,7 @@ tags:
   - IcedID
   - Active Directory Lateral Movement
   - Industroyer2
+  - CISA AA22-257A
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
index 6741d19efd..65237b9068 100644
--- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
@@ -33,6 +33,7 @@ tags:
   - Windows Persistence Techniques
   - Industroyer2
   - DarkCrystal RAT
+  - CISA AA22-257A
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml
index d09385d7d4..f8e4e35a53 100644
--- a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml
+++ b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml
@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - CISA AA22-257A
   asset_type: Endpoint
   confidence: 50
   context:
diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml
index fadb559859..77f3346d18 100644
--- a/detections/web/log4shell_jndi_payload_injection_attempt.yml
+++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml
@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/stories/cisa_aa22_257a.yml b/stories/cisa_aa22_257a.yml
new file mode 100644
index 0000000000..489a6ba149
--- /dev/null
+++ b/stories/cisa_aa22_257a.yml
@@ -0,0 +1,25 @@
+name: CISA AA22-257A
+id: e1aec96e-bc7d-4edf-8ff7-3da9b7b29147
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+description: The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations.
+narrative: This advisory updates joint CSA Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities, which provides information on these Iranian government-sponsored APT actors exploiting known Fortinet and Microsoft Exchange vulnerabilities to gain initial access to a broad range of targeted entities in furtherance of malicious activities, including ransom operations. The authoring agencies now judge these actors are an APT group affiliated with the IRGC.
+  Since the initial reporting of this activity in the FBI Liaison Alert System (FLASH) report APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity from May 2021, the authoring agencies have continued to observe these IRGC-affiliated actors exploiting known vulnerabilities for initial access. In addition to exploiting Fortinet and Microsoft Exchange vulnerabilities, the authoring agencies have observed these APT actors exploiting VMware Horizon Log4j vulnerabilities for initial access. The IRGC-affiliated actors have used this access for follow-on activity, including disk encryption and data extortion, to support ransom operations.
+  The IRGC-affiliated actors are actively targeting a broad range of entities, including entities across multiple U.S. critical infrastructure sectors as well as Australian, Canadian, and United Kingdom organizations. These actors often operate under the auspices of Najee Technology Hooshmand Fater LLC, based in Karaj, Iran, and Afkar System Yazd Company, based in Yazd, Iran. The authoring agencies assess the actors are exploiting known vulnerabilities on unprotected networks rather than targeting specific targeted entities or sectors.
+  This advisory provides observed tactics, techniques, and indicators of compromise (IOCs) that the authoring agencies assess are likely associated with this IRGC-affiliated APT. The authoring agencies urge organizations, especially critical infrastructure organizations, to apply the recommendations listed in the Mitigations section of this advisory to mitigate risk of compromise from these IRGC-affiliated cyber actors.
+references:
+  - https://www.cisa.gov/uscert/ncas/alerts/aa21-321a
+  - https://www.cisa.gov/uscert/ncas/alerts/aa22-257a
+  - https://www.ic3.gov/Media/News/2021/210527.pdf
+  - https://www.us-cert.gov/sites/default/files/AA22-257A.stix.xml
+  - https://www.us-cert.cisa.gov/iran
+tags:
+  analytic_story: CISA AA22-257A
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

From 615b24fe6d79f3328c3b82e64d2adbb3bf360642 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 10:52:56 -0600
Subject: [PATCH 18/27] PLINK

---
 .../windows_protocol_tunneling_with_plink.yml | 82 +++++++++++++++++++
 ...ows_protocol_tunneling_with_plink.test.yml | 13 +++
 2 files changed, 95 insertions(+)
 create mode 100644 detections/endpoint/windows_protocol_tunneling_with_plink.yml
 create mode 100644 tests/endpoint/windows_protocol_tunneling_with_plink.test.yml

diff --git a/detections/endpoint/windows_protocol_tunneling_with_plink.yml b/detections/endpoint/windows_protocol_tunneling_with_plink.yml
new file mode 100644
index 0000000000..a97fc7bdc1
--- /dev/null
+++ b/detections/endpoint/windows_protocol_tunneling_with_plink.yml
@@ -0,0 +1,82 @@
+name: Windows Protocol Tunneling with Plink
+id: 8aac5e1e-0fab-4437-af0b-c6e60af23eed
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of Plink being utilized to proxy egress or laterally in an organization. The analytic is limited to specific Plink options on the command-line, including -R -L and -D which will have the remote and local IP address or port and -l for a username. Modify the options as seen fit for your organization. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=plink.exe OR Processes.original_file_name=Plink
+  Processes.process IN ("*-R *", "*-L *", "*-D *", "*-l *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `windows_protocol_tunneling_with_plink_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present if the organization allows for SSH tunneling outbound or internally. Filter as needed.
+references:
+  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+  - https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
+  - https://attack.mitre.org/techniques/T1572/
+  - https://documentation.help/PuTTY/using-cmdline-portfwd.html#S3.8.3.5
+tags:
+  analytic_story:
+  - CISA AA22-257A
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/plink-windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Command & Control
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to tunnel to a remote destination.
+  mitre_attack_id:
+  - T1572
+  - T1021.004
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/windows_protocol_tunneling_with_plink.test.yml b/tests/endpoint/windows_protocol_tunneling_with_plink.test.yml
new file mode 100644
index 0000000000..613ffac228
--- /dev/null
+++ b/tests/endpoint/windows_protocol_tunneling_with_plink.test.yml
@@ -0,0 +1,13 @@
+name: Windows Protocol Tunneling with Plink Unit Test
+tests:
+- name: Windows Protocol Tunneling with Plink
+  file: endpoint/windows_protocol_tunneling_with_plink.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: plink-windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/plink-windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 5e85c0dd7cd6dd04d0b85b80f31be7ba05232a7d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 12:19:18 -0600
Subject: [PATCH 19/27] Windows Ingress Tool Transfer Using Explorer SSA

---
 ...s_ingress_tool_transfer_using_explorer.yml | 88 +++++++++++++++++++
 ...ress_tool_transfer_using_explorer.test.yml | 11 +++
 2 files changed, 99 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
 create mode 100644 tests/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.test.yml

diff --git a/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
new file mode 100644
index 0000000000..b89e750284
--- /dev/null
+++ b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
@@ -0,0 +1,88 @@
+name: Windows Ingress Tool Transfer Using Explorer
+id: 9b35c538-94ef-11ec-9439-acde4800322z
+version: 1
+date: '2022-09-13'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the Windows Explorer process with a URL within the command-line.
+  Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. 
+  Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application 
+  on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
+  which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="explorer.exe" 
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))
+| NOT (like(parent_process_name, "userinit.exe") OR like(parent_process_name, "svchost.exe"))
+| eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints.
+known_false_positives: False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names. 
+references:
+  - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
+tags:
+  analytic_story:
+  - DarkCrystal RAT
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
+    destination to download an additional payload.
+  mitre_attack_id:
+  - T1105
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 25
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/tests/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.test.yml b/tests/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.test.yml
new file mode 100644
index 0000000000..b1c18f3e38
--- /dev/null
+++ b/tests/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.test.yml
@@ -0,0 +1,11 @@
+name: Windows Ingress Tool Transfer Using Explorer Unit Test
+tests:
+- name: Windows Ingress Tool Transfer Using Explorer
+  file: endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: T1105_explorer-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file

From 7a95a27a2c70c21bb398b973dde3f0babac32c1f Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 12:42:34 -0600
Subject: [PATCH 20/27] ODBC

---
 ...s_ingress_tool_transfer_using_explorer.yml |  2 +-
 ...___windows_odbcconf_load_response_file.yml | 84 +++++++++++++++++++
 ...tion_compiled_html_file_decompile.test.yml |  3 +-
 ...tml_file_url_in_command_line.test copy.yml | 10 +++
 4 files changed, 96 insertions(+), 3 deletions(-)
 create mode 100644 detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml

diff --git a/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
index b89e750284..dfb7da4827 100644
--- a/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+++ b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
@@ -1,5 +1,5 @@
 name: Windows Ingress Tool Transfer Using Explorer
-id: 9b35c538-94ef-11ec-9439-acde4800322z
+id: 695bfad6-9662-4f9e-a576-bf02a951aa60
 version: 1
 date: '2022-09-13'
 author: Michael Haag, Splunk
diff --git a/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
new file mode 100644
index 0000000000..972d563a6c
--- /dev/null
+++ b/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
@@ -0,0 +1,84 @@
+name: Windows Odbcconf Load Response File
+id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the odbcconf.exe, Windows Open Database
+  Connectivity utility, loading up a resource file. The file extension is arbitrary
+  and may be named anything. The resource file itself may have different commands
+  supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands.
+  During triage, review file modifications and parallel processes.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="odbcconf.exe"
+  AND (like (cmd_line, "%-f %") OR like (cmd_line, "%/f %")) AND like (cmd_line, "%.rsp%") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present and filtering may need to occur
+  based on legitimate application usage. Filter as needed.
+references:
+  - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
+  - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ has been identified on $dest_device_id$ under user $dest_user_id$ attempting to circumvent controls.
+  mitre_attack_id:
+  - T1218.008
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
index 910f26b248..2edf7f07ae 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
@@ -6,6 +6,5 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog
-    sourcetype: XmlWinEventLog
+    source: WinEventLog:Security
     update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml
new file mode 100644
index 0000000000..9f67c39c8d
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml	
@@ -0,0 +1,10 @@
+name: Windows Odbcconf Load Response File Unit Test
+tests:
+- name: Windows Odbcconf Load Response File
+  file: endpoint/ssa___windows_odbcconf_load_response_file.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: odbcconf-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
+    source: WinEventLog:Security
+    update_timestamp: true
\ No newline at end of file

From 81dcbae81c31a1791330a5d84551d5ab75ace99b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 13:02:54 -0600
Subject: [PATCH 21/27] Update ssa___windows_odbcconf_load_response_file.yml

---
 .../endpoint/ssa___windows_odbcconf_load_response_file.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
index 972d563a6c..0e581d803b 100644
--- a/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
+++ b/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
@@ -79,6 +79,6 @@ tags:
   - dest_user_id
   - process
   - cmd_line
-  risk_score: 90
+  risk_score: 42
   security_domain: endpoint
   asset_type: Endpoint

From 0597208d3d06bb00b299031754dfbb7fa867ac96 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 13:06:37 -0600
Subject: [PATCH 22/27] cant type

---
 ...opy.yml => ssa___windows_odbcconf_load_response_file.test.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename tests/endpoint/{ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml => ssa___windows_odbcconf_load_response_file.test.yml} (100%)

diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml b/tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml
similarity index 100%
rename from tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml
rename to tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml

From 6d1734b9025c4cf8a40c5e2706f1f14d493034e9 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 13:43:28 -0600
Subject: [PATCH 23/27] msdt

---
 ...s_execute_arbitrary_commands_with_msdt.yml | 92 +++++++++++++++++++
 ...cute_arbitrary_commands_with_msdt.test.yml | 10 ++
 2 files changed, 102 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
 create mode 100644 tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml

diff --git a/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
new file mode 100644
index 0000000000..e9052cce23
--- /dev/null
+++ b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
@@ -0,0 +1,92 @@
+name: Windows Execute Arbitrary Commands with MSDT
+id: f253f9c2-10f0-4cc8-b469-f505ba8c2038
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies a recently disclosed arbitraty command
+  execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample
+  identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve
+  a remote payload. During triage, review file modifications for html. Identify parallel
+  process execution that may be related, including an Office Product.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
+  AND (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%") OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%"))
+  AND (like (cmd_line, "%IT_BrowseForFile=%") OR like (cmd_line, "%IT_RebrowseForFile=%") OR like (cmd_line, ".xml"))
+  AND like (cmd_line, "%PCWDiagnostic%")
+  | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter as needed. Added .xml
+  to potentially capture any answer file usage. Remove as needed.
+references:
+  - https://isc.sans.edu/diary/rss/28694
+  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story:
+  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
+  impact: 100 
+  cve:
+  - CVE-2022-30190
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ on $dest_device_id$ under user $dest_user_id$ possibly indicative of indirect command execution.
+  mitre_attack_id:
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 100
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml b/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml
new file mode 100644
index 0000000000..b7aff1a4fa
--- /dev/null
+++ b/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml
@@ -0,0 +1,10 @@
+name: Windows Execute Arbitrary Commands with MSDT Unit Test
+tests:
+- name: Windows Execute Arbitrary Commands with MSDT
+  file: endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: msdt-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
+    source: WinEventLog:Security
+    update_timestamp: true
\ No newline at end of file

From 593c433ae8c473f5e4730882113483fee8488664 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 16 Sep 2022 12:47:19 -0600
Subject: [PATCH 24/27] fixes

fixes
---
 ...sa___windows_ingress_tool_transfer_using_explorer.yml | 9 +++------
 ...tart_execution_lsass_driver_registry_modification.yml | 2 +-
 ...windows_execute_arbitrary_commands_with_msdt.test.yml | 3 ++-
 .../ssa___windows_odbcconf_load_response_file.test.yml   | 3 ++-
 4 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
index dfb7da4827..4c6fb09e33 100644
--- a/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+++ b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
@@ -18,9 +18,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="explorer.exe" 
-  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))
-| NOT (like(parent_process_name, "userinit.exe") OR like(parent_process_name, "svchost.exe"))
-| eval start_time=timestamp,
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) AND NOT (like(parent_process_name, "userinit.exe") OR like(parent_process_name, "svchost.exe"))
+  | eval start_time=timestamp,
   end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
   "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
   body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
@@ -48,9 +47,7 @@ tags:
   impact: 50
   kill_chain_phases:
   - Exploitation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
-    destination to download an additional payload.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote destination to download an additional payload.
   mitre_attack_id:
   - T1105
   nist:
diff --git a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
index 129df31941..9d027b5d02 100644
--- a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
+++ b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
@@ -36,7 +36,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: the registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$.
+  message: The registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$.
   mitre_attack_id:
   - T1547.008
   nist:
diff --git a/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml b/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml
index b7aff1a4fa..8dd5540c24 100644
--- a/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml
+++ b/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml
@@ -6,5 +6,6 @@ tests:
   attack_data:
   - file_name: msdt-windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
-    source: WinEventLog:Security
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
     update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml b/tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml
index 9f67c39c8d..843ce99214 100644
--- a/tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml
+++ b/tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml
@@ -6,5 +6,6 @@ tests:
   attack_data:
   - file_name: odbcconf-windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
-    source: WinEventLog:Security
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
     update_timestamp: true
\ No newline at end of file

From 0e9f00f19fe1141bb1084f1da4dab2339714d262 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 16 Sep 2022 13:10:09 -0600
Subject: [PATCH 25/27] Update
 ssa___windows_execute_arbitrary_commands_with_msdt.yml

---
 ...___windows_execute_arbitrary_commands_with_msdt.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
index e9052cce23..4a45b12204 100644
--- a/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+++ b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
@@ -16,11 +16,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
-  AND (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%") OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%"))
-  AND (like (cmd_line, "%IT_BrowseForFile=%") OR like (cmd_line, "%IT_RebrowseForFile=%") OR like (cmd_line, ".xml"))
-  AND like (cmd_line, "%PCWDiagnostic%")
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
+  | where (like(cmd_line, "%msdt%") OR like(cmd_line, %ms-msdt:%") OR like(cmd_line, "%ms-msdt:/id%")) 
+  | where (like(cmd_line, "%it_browseforfile=%") OR like(cmd_line, "%it_rebrowseforfile=%") OR like(cmd_line, "%.xml%"))
+  | where like(cmd_line, "%pcwdiagnostic%")
   | eval start_time=timestamp, end_time=timestamp,
   entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
   "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",

From 206e8264923e540aa68d58e31f1ca506a2b21cd0 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 16 Sep 2022 13:29:25 -0600
Subject: [PATCH 26/27] Update
 ssa___windows_execute_arbitrary_commands_with_msdt.yml

---
 ...___windows_execute_arbitrary_commands_with_msdt.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
index 4a45b12204..9ab9a62874 100644
--- a/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+++ b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
@@ -16,11 +16,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
-  | where (like(cmd_line, "%msdt%") OR like(cmd_line, %ms-msdt:%") OR like(cmd_line, "%ms-msdt:/id%")) 
-  | where (like(cmd_line, "%it_browseforfile=%") OR like(cmd_line, "%it_rebrowseforfile=%") OR like(cmd_line, "%.xml%"))
-  | where like(cmd_line, "%pcwdiagnostic%")
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
+  AND (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%") OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%"))
+  AND (like (cmd_line, "%it_browseforfile=%") OR like (cmd_line, "%it_rebrowseforfile=%") OR like (cmd_line, "%.xml%"))
+  AND like (cmd_line, "%pcwdiagnostic%")
   | eval start_time=timestamp, end_time=timestamp,
   entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
   "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",

From 713c605097b11351d66210af54450b0bb252d965 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Fri, 16 Sep 2022 14:37:13 -0500
Subject: [PATCH 27/27] adding files into dist

---
 ...s_execute_arbitrary_commands_with_msdt.yml | 74 +++++++++++++++++
 ...s_ingress_tool_transfer_using_explorer.yml | 68 +++++++++++++++
 ...ows_lolbin_binary_in_non_standard_path.yml | 35 ++++----
 ...___windows_odbcconf_load_response_file.yml | 68 +++++++++++++++
 ...tial_dumping_with_ntdsutil_export_ntds.yml | 73 +++++++++++++++++
 ...ws_os_credential_dumping_with_procdump.yml | 70 ++++++++++++++++
 ...execution_compiled_html_file_decompile.yml | 70 ++++++++++++++++
 ...compiled_html_file_url_in_command_line.yml | 79 ++++++++++++++++++
 ...l_file_using_infotech_storage_handlers.yml | 82 +++++++++++++++++++
 ...xy_execution_msiexec_dllregisterserver.yml | 60 ++++++++++++++
 ...roxy_execution_msiexec_remote_download.yml | 60 ++++++++++++++
 ...proxy_execution_msiexec_unregister_dll.yml | 60 ++++++++++++++
 12 files changed, 781 insertions(+), 18 deletions(-)
 create mode 100644 dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml
 create mode 100644 dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml
 create mode 100644 dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml
 create mode 100644 dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
 create mode 100644 dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml

diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml
new file mode 100644
index 0000000000..ab8dbda383
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml
@@ -0,0 +1,74 @@
+name: Windows Execute Arbitrary Commands with MSDT
+id: f253f9c2-10f0-4cc8-b469-f505ba8c2038
+version: 1
+description: The following analytic identifies a recently disclosed arbitraty command
+  execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample
+  identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve
+  a remote payload. During triage, review file modifications for html. Identify parallel
+  process execution that may be related, including an Office Product.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe" AND
+  (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%")
+  OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%")) AND (like
+  (cmd_line, "%it_browseforfile=%") OR like (cmd_line, "%it_rebrowseforfile=%") OR
+  like (cmd_line, "%.xml%")) AND like (cmd_line, "%pcwdiagnostic%") | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter as needed. Added .xml
+  to potentially capture any answer file usage. Remove as needed.
+references:
+- https://isc.sans.edu/diary/rss/28694
+- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story:
+  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 100
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/f253f9c2-10f0-4cc8-b469-f505ba8c2038/
+test:
+  name: Windows Execute Arbitrary Commands with MSDT Unit Test
+  tests:
+  - name: Windows Execute Arbitrary Commands with MSDT
+    file: endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: msdt-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml
new file mode 100644
index 0000000000..82711dd489
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml
@@ -0,0 +1,68 @@
+name: Windows Ingress Tool Transfer Using Explorer
+id: 695bfad6-9662-4f9e-a576-bf02a951aa60
+version: 1
+description: The following analytic identifies the Windows Explorer process with a
+  URL within the command-line. Explorer.exe is known Windows process that handles
+  start menu, taskbar, desktop and file manager. Many adversaries abuse this process,
+  like DCRat malware, where it attempts to open the URL with the default browser application
+  on the target host by putting the URL as a parameter on explorer.exe process. This
+  anomaly detection might be a good pivot to check which user and how this process
+  was executed, what is the parent process and what is the URL link. This technique
+  is not commonly used to open an URL.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="explorer.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) AND NOT (like(parent_process_name,
+  "userinit.exe") OR like(parent_process_name, "svchost.exe")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints.
+known_false_positives: False positives may be present based on legitimate applications
+  or third party utilities. Filter out any additional parent process names.
+references:
+- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
+tags:
+  analytic_story:
+  - DarkCrystal RAT
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1105
+  nist:
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 25
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/695bfad6-9662-4f9e-a576-bf02a951aa60/
+test:
+  name: Windows Ingress Tool Transfer Using Explorer Unit Test
+  tests:
+  - name: Windows Ingress Tool Transfer Using Explorer
+    file: endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: T1105_explorer-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
index e60a9df909..f0428a0b28 100644
--- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -14,24 +14,23 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
   $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe"
-  OR process_name="at.exe" OR process_name="atbroker.exe"
-  OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe"
-  OR process_name="certutil.exe" OR process_name="cmdkey.exe" OR process_name="cmdl32.exe"
-  OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe"
-  OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe"
-  OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR process_name="diskshadow.exe"
-  OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe"
-  OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe"
-  OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe"
-  OR process_name="fltmc.exe" OR process_name="forfiles.exe" OR process_name="ftp.exe"
-  OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe"
-  OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe"
-  OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe"
-  OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe"
-  OR process_name="msdt.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
-  OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe"
-  OR process_name="pcalua.exe" OR
-  process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe"
+  OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bitsadmin.exe"
+  OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe"
+  OR process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe"
+  OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe"
+  OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe"
+  OR process_name="diantz.exe" OR process_name="diskshadow.exe" OR process_name="dllhost.exe"
+  OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe"
+  OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe"
+  OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe"
+  OR process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe"
+  OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe"
+  OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe"
+  OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe"
+  OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe"
+  OR process_name="mshta.exe" OR process_name="msiexec.exe" OR process_name="netsh.exe"
+  OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="pcalua.exe"
+  OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe"
   OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe"
   OR process_name="psr.exe" OR process_name="rasautou.exe" OR process_name="reg.exe"
   OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe"
diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml
new file mode 100644
index 0000000000..a3f28966b7
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml
@@ -0,0 +1,68 @@
+name: Windows Odbcconf Load Response File
+id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763
+version: 1
+description: The following analytic identifies the odbcconf.exe, Windows Open Database
+  Connectivity utility, loading up a resource file. The file extension is arbitrary
+  and may be named anything. The resource file itself may have different commands
+  supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands.
+  During triage, review file modifications and parallel processes.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="odbcconf.exe"
+  AND (like (cmd_line, "%-f %") OR like (cmd_line, "%/f %")) AND like (cmd_line, "%.rsp%")
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present and filtering may need to occur
+  based on legitimate application usage. Filter as needed.
+references:
+- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
+- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.008
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 42
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/7b6c3fac-0c37-4efc-a85e-de88f42b6763/
+test:
+  name: Windows Odbcconf Load Response File Unit Test
+  tests:
+  - name: Windows Odbcconf Load Response File
+    file: endpoint/ssa___windows_odbcconf_load_response_file.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: odbcconf-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
new file mode 100644
index 0000000000..2ee634c347
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
@@ -0,0 +1,73 @@
+name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e
+version: 1
+description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
+  database - NTDS.dit, typically used for offline password cracking. It may be used
+  in normal circumstances with no command line arguments or shorthand variations of
+  more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
+  command used to dump ntds.dit \
+
+  ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
+
+  This technique uses "Install from Media" (IFM), which will extract a copy of the
+  Active Directory database. A successful export of the Active Directory database
+  will yield a file modification named ntds.dit to the destination.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="ntdsutil.exe"
+  AND (like (cmd_line, "%ntds%") AND like (cmd_line, "%create%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Highly possible Server Administrators will troubleshoot with
+  ntdsutil.exe, generating false positives.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  - Living Off The Land
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.003
+  - T1003
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 50
+  security_domain: endpoint
+  risk_severity: medium
+  research_site_url: https://research.splunk.com/endpoint/dad9ddec-a72a-47be-87b6-a0f7ba98ed6e/
+test:
+  name: Windows OS Credential Dumping with Ntdsutil Export NTDS Unit Test
+  tests:
+  - name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+    file: endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml
new file mode 100644
index 0000000000..5baa10def5
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml
@@ -0,0 +1,70 @@
+name: Windows OS Credential Dumping with Procdump
+id: e102e297-dbe6-4a19-b319-5c08f4c19a06
+version: 1
+description: 'Detect procdump.exe dumping the lsass process. This query looks for
+  both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
+  file with all process memory. Both are highly suspect and should be reviewed. This
+  query does not monitor for the internal name (original_file_name=procdump) of the
+  PE or look for procdump64.exe. Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on
+  the command line. Review other endpoint data sources for cross process (injection)
+  into lsass.exe.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND (process_name="procdump.exe"
+  OR process_name="procdump64.exe") AND (like (cmd_line, "%-mm %") OR like (cmd_line,
+  "%-ma %")) AND like (cmd_line, "%lsass%") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: None identified.
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.001
+  - T1003
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/e102e297-dbe6-4a19-b319-5c08f4c19a06/
+test:
+  name: Windows OS Credential Dumping with Procdump Unit Test
+  tests:
+  - name: Windows OS Credential Dumping with Procdump
+    file: endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: procdump_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
new file mode 100644
index 0000000000..111da21cfc
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -0,0 +1,70 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+id: 11c32b19-05a6-48a8-ab28-18dbd9ec5d50
+version: 1
+description: The following analytic identifies the decompile parameter with the HTML
+  Help application, HH.exe. This is a uncommon command to see ran and behavior. Most
+  recently this was seen in a APT41 campaign where a CHM file was delivered and a
+  script inside used a technique for running an arbitrary command in a CHM file via
+  an ActiveX object. This unpacks an HTML help file to a specified path for launching
+  the next stage.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
+  like (cmd_line, "%-decompile%")| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives should be limited, filter as needed.
+references:
+- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://attack.mitre.org/techniques/T1218/001/
+- https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/11c32b19-05a6-48a8-ab28-18dbd9ec5d50/
+test:
+  name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+    file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+      source: WinEventLog:Security
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
new file mode 100644
index 0000000000..fa03eca60d
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
@@ -0,0 +1,79 @@
+name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+id: 0fec631a-7c9b-4e4c-b28b-93260953e25f
+version: 1
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file from a remote url. This particular technique will load Windows
+  script code from a compiled help file. CHM files may  contain nearly any file type
+  embedded, but only execute html/htm. Upon a successful execution, the following
+  script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode,
+  JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe
+  upon execution. The "htm" and "html" file extensions were the only extensions observed
+  to be supported for the execution of Shortcut commands or WSH script code. During
+  investigation, identify script content origination. Review reputation of remote
+  IP and domain. Some instances, it is worth decompiling the .chm file to review its
+  original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
+  (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))| eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although unlikely, some legitimate applications may retrieve
+  a CHM remotely, filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1218/001/
+- https://www.kb.cert.org/vuls/id/851869
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+- https://lolbas-project.github.io/lolbas/Binaries/Hh/
+- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/0fec631a-7c9b-4e4c-b28b-93260953e25f/
+test:
+  name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+    Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution Compiled HTML File URL In Command
+      Line
+    file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_url_in_command_line.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: chm-wineventlog-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+      source: WinEventLog:Security
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
new file mode 100644
index 0000000000..a00b77cc59
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
@@ -0,0 +1,82 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage
+  Handlers
+id: ba0c2450-caea-4086-ac3a-a71e2659754b
+version: 1
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
+  will load Windows script code from a compiled help file, using InfoTech Storage
+  Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are
+  supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm
+  file from within a CHM file. CHM files may contain nearly any file type embedded.
+  Upon a successful execution, the following script engines may be used for execution
+  - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may
+  identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm"
+  and "html" file extensions were the only extensions observed to be supported for
+  the execution of Shortcut commands or WSH script code. During investigation, identify
+  script content origination. hh.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
+  (like (cmd_line, "%its:%") OR like (cmd_line, "%mk:@MSITStore:%"))| eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
+  used, but it does happen in some legitimate instances. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1218/001/
+- https://www.kb.cert.org/vuls/id/851869
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+- https://lolbas-project.github.io/lolbas/Binaries/Hh/
+- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 72
+  security_domain: endpoint
+  risk_severity: medium
+  research_site_url: https://research.splunk.com/endpoint/ba0c2450-caea-4086-ac3a-a71e2659754b/
+test:
+  name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage
+    Handlers Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech
+      Storage Handlers
+    file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_using_infotech_storage_handlers.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: chm-wineventlog-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+      source: WinEventLog:Security
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
new file mode 100644
index 0000000000..7d8c7f0b1f
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
@@ -0,0 +1,60 @@
+name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+id: 8d1d5570-722c-49a3-996c-2e2cceef5163
+version: 1
+description: The following analytic identifies the usage of msiexec.exe using the
+  /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/y %") OR like (cmd_line, "%-y %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: This analytic will need to be tuned for your environment based
+  on legitimate usage of msiexec.exe. Filter as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/8d1d5570-722c-49a3-996c-2e2cceef5163/
+test:
+  name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+    file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_msiexec-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
new file mode 100644
index 0000000000..1cb8e6a1f6
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
@@ -0,0 +1,60 @@
+name: Windows System Binary Proxy Execution MSIExec Remote Download
+id: 92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5
+version: 1
+description: The following analytic identifies msiexec.exe with http in the command-line.
+  This procedure will utilize msiexec.exe to download a remote file and load it. During
+  triage, review parallel processes and capture any artifacts on disk for review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5/
+test:
+  name: Windows System Binary Proxy Execution MSIExec Remote Download Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution MSIExec Remote Download
+    file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_msiexec-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
new file mode 100644
index 0000000000..488030cdcc
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
@@ -0,0 +1,60 @@
+name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+id: df76a8d1-92e1-4ec9-b8f7-695b5838703e
+version: 1
+description: The following analytic identifies the usage of msiexec.exe using the
+  /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/z %") OR like (cmd_line, "%-z %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/df76a8d1-92e1-4ec9-b8f7-695b5838703e/
+test:
+  name: Windows System Binary Proxy Execution MSIExec Unregister DLL Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+    file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_msiexec-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+      source: XmlWinEventLog