Branch was auto-updated.

detections/endpoint/detect_renamed_rclone.yml

@@ -4,7 +4,8 @@ version: 2
 date: '2021-09-16'
 author: Michael Haag, Splunk
 type: Hunting
-datamodel: []
+datamodel: 
+- Endpoint
 description: The following analytic identifies the usage of `rclone.exe`, renamed,
   being used to exfiltrate data to a remote destination. RClone has been used by multiple
   ransomware groups to exfiltrate data. In many instances, it will be downloaded from

detections/endpoint/disabling_remote_user_account_control.yml

@@ -4,7 +4,8 @@ version: 4
 date: '2020-11-18'
 author: David Dorsey, Patrick Bareiss, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: The search looks for modifications to registry keys that control the
   enforcement of Windows User Account Control (UAC).
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)

detections/endpoint/monitor_registry_keys_for_print_monitors.yml

@@ -4,7 +4,8 @@ version: 3
 date: '2020-01-28'
 author: Bhavin Patel, Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search looks for registry activity associated with modifications
   to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this
   scenario, an attacker can load an arbitrary .dll into the print-monitor registry

detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml

@@ -1,10 +1,12 @@
 name: Outbound Network Connection from Java Using Default Ports
 id: d2c14d28-5c47-11ec-9892-acde48001122
-version: 1
-date: '2021-12-13'
-author: Mauricio Velazco, Splunk
+version: 2
+date: '2022-06-28'
+author: Mauricio Velazco, Lou Stella, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint
+- Network_Traffic
 description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability
   is that the victim server will perform outbound connections to attacker-controlled
   infrastructure. This is required as part of the JNDI lookup as well as for retrieving
@@ -12,16 +14,7 @@ description: A required step while exploiting the CVE-2021-44228-Log4j vulnerabi
   reaching out to default ports used by the LDAP and RMI protocols. This behavior
   could represent successfull exploitation. Note that adversaries can easily decide
   to use arbitrary ports for these protocols and potentially bypass this detection.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR
-  Processes.process_name=javaw.exe) by _time Processes.process_guid Processes.process_name
-  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
-  |  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | join  process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports
-  where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR
-  Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)`
-  |  rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
-  process_path process connection_to_CNC dest_port | `outbound_network_connection_from_java_using_default_ports_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe) by _time Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process connection_to_CNC dest_port| `outbound_network_connection_from_java_using_default_ports_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -59,15 +52,15 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_guid
+  - Processes.process_id
   - Processes.process_name
   - Processes.dest
   - Processes.process_path
   - Processes.process
   - Processes.parent_process_name
-  - Ports.process_guid
-  - Ports.dest
-  - Ports.dest_port
+  - All_Traffic.process_id
+  - All_Traffic.dest
+  - All_Traffic.dest_port
   risk_score: 54
   security_domain: endpoint
   asset_type: Endpoint

detections/endpoint/registry_keys_for_creating_shim_databases.yml

@@ -4,7 +4,8 @@ version: 4
 date: '2020-01-28'
 author: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint
 description: This search looks for registry activity associated with application compatibility
   shims, which can be leveraged by attackers for various nefarious purposes.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry

detections/endpoint/registry_keys_used_for_privilege_escalation.yml

@@ -4,7 +4,8 @@ version: 5
 date: '2022-01-26'
 author: David Dorsey, Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint
 description: This search looks for modifications to registry keys that can be used
   to elevate privileges. The registry keys under "Image File Execution Options" are
   used to intercept calls to an executable and can be used to attach malicious binaries

detections/endpoint/ryuk_test_files_detected.yml

@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-06'
 author: Rod Soto, Jose Hernandez, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: The search looks for files that contain the key word *Ryuk* under any
   folder in the C drive, which is consistent with Ryuk propagation.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)

detections/endpoint/shim_database_file_creation.yml

@@ -4,7 +4,8 @@ version: 3
 date: '2020-12-08'
 author: David Dorsey, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint
 description: This search looks for shim database files being written to default directories.
   The sdbinst.exe application is used to install shim database files (.sdb). According
   to Microsoft, a shim is a small library that transparently intercepts an API, changes

detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml

@@ -4,7 +4,8 @@ version: 4
 date: '2020-07-22'
 author: Rico Valdez, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint
 description: This search detects writes to the recycle bin by a process other than
   explorer.exe.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)

detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml

@@ -4,7 +4,8 @@ version: 1
 date: '2022-03-28'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel: []
+datamodel: 
+- Endpoint
 description: This analytic is to detect deletion of registry with suspicious process file path. This technique was seen in Double Zero wiper malware 
   where it will delete all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload to the targeted hosts. This anomaly detections 
   can catch possible malware or advesaries deleting registry as part of defense evasion or even payload impact but can also catch for third party application 

detections/endpoint/windows_security_account_manager_stopped.yml

@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-06'
 author: Rod Soto, Jose Hernandez, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint
 description: The search looks for a Windows Security Account Manager (SAM) was stopped
   via command-line. This is consistent with Ryuk infections across a fleet of endpoints.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)