updates from Lou

detections/application/splunk_user_enumeration_attempt.yml

@@ -1,7 +1,7 @@
 name: Splunk User Enumeration Attempt
 id: 25625cb4-1c4d-4463-b0f9-7cb462699cde
-version: 2
-date: '2023-07-31'
+version: 1
+date: '2022-04-29'
 author: Lou Stella, Splunk
 status: production
 type: TTP
@@ -11,7 +11,7 @@ description: On May 3rd, 2022, Splunk published a security advisory for  usernam
   as well as actual exploitation in unpatched version of Splunk.
 data_source: []
 search: ' `splunkd_failed_auths` | stats count(user) as auths by user, src | where
-  auths>5 | stats dc(user) as "Users", sum(auths) as TotalFailedAuths by src |
+  auths>5 | stats values(user) as "Users", sum(auths) as TotalFailedAuths by src |
   `splunk_user_enumeration_attempt_filter`'
 how_to_implement: This detection does not require you to ingest any new data. The
   detection does require the ability to search the _audit index. This detection may

detections/endpoint/disable_etw_through_registry.yml

@@ -13,7 +13,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
-  Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path
+  Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.dest Registry.registry_path
   Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
   Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`'