From b3128e8e857fa4a16ac5626fed441421d70c8788 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Mar 2023 14:46:12 -0600
Subject: [PATCH 1/9] every haag everywhere all at once

---
 .../windows_lateral_tool_transfer_remcom.yml  | 79 +++++++++++++++++++
 ...dows_lateral_tool_transfer_remcom.test.yml | 13 +++
 2 files changed, 92 insertions(+)
 create mode 100644 detections/endpoint/windows_lateral_tool_transfer_remcom.yml
 create mode 100644 tests/endpoint/windows_lateral_tool_transfer_remcom.test.yml

diff --git a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml b/detections/endpoint/windows_lateral_tool_transfer_remcom.yml
new file mode 100644
index 0000000000..09043be3ed
--- /dev/null
+++ b/detections/endpoint/windows_lateral_tool_transfer_remcom.yml
@@ -0,0 +1,79 @@
+name: Windows Lateral Tool Transfer RemCom
+id: e373a840-5bdc-47ef-b2fd-9cc7aaf387f0
+version: 1
+date: '2023-03-20'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic identifies the use of RemCom.exe - The open source psexec. This utility provides the ability to move laterally and run scripts or commands remotely.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=remcom.exe OR Processes.original_file_name=RemCom.exe) Processes.process="*\\*" Processes.process IN ("*/user:*", "*/pwd:*")
+   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_lateral_tool_transfer_remcom_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present based on Administrative use. Filter as needed.
+references:
+  - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
+  - https://github.com/kavika13/RemCom
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/remcom_windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Installation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally.
+  mitre_attack_id:
+  - T1570
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 40
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/windows_lateral_tool_transfer_remcom.test.yml b/tests/endpoint/windows_lateral_tool_transfer_remcom.test.yml
new file mode 100644
index 0000000000..e2a3f3d374
--- /dev/null
+++ b/tests/endpoint/windows_lateral_tool_transfer_remcom.test.yml
@@ -0,0 +1,13 @@
+name: Windows Lateral Tool Transfer RemCom Unit Test
+tests:
+- name: Windows Lateral Tool Transfer RemCom
+  file: endpoint/windows_lateral_tool_transfer_remcom.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: remcom_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/remcom_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 7b0c83eee0aa2e960c187b5ba5f78f0e304d8eb0 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Mar 2023 15:26:20 -0600
Subject: [PATCH 2/9] MOCMER

---
 .../windows_service_create_remcomsvc.yml      | 57 +++++++++++++++++++
 .../windows_service_create_remcomsvc.test.yml | 13 +++++
 2 files changed, 70 insertions(+)
 create mode 100644 detections/endpoint/windows_service_create_remcomsvc.yml
 create mode 100644 tests/endpoint/windows_service_create_remcomsvc.test.yml

diff --git a/detections/endpoint/windows_service_create_remcomsvc.yml b/detections/endpoint/windows_service_create_remcomsvc.yml
new file mode 100644
index 0000000000..2f3d2d0f35
--- /dev/null
+++ b/detections/endpoint/windows_service_create_remcomsvc.yml
@@ -0,0 +1,57 @@
+name: Windows Service Create RemComSvc
+id: 0be4b5d6-c449-4084-b945-2392b519c33b
+version: 1
+date: '2023-03-20'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies RemComSvc installed on an endpoint. This typically occurs when someone is moving laterally with RemCom.exe.
+search: '`wineventlog_system` EventCode=7045 ServiceName="RemCom Service" | stats count min(_time) as firstTime max(_time) as lastTime by
+  dest ImagePath ServiceName ServiceType   | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_service_create_remcomsvc_filter`'
+how_to_implement: To implement this analytic, the Windows EventCode 7045 will need to be logged. The Windows TA for Splunk is also recommended.
+known_false_positives: False positives may be present, filter as needed based on administrative activity.
+references:
+  - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
+  - https://github.com/kavika13/RemCom
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/remcom_windows-system.log
+  impact: 40
+  kill_chain_phases:
+  - Installation
+  message:  A new service was created related to RemCom on $dest$.
+  mitre_attack_id:
+  - T1543.003
+  - T1543
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest 
+  - EventCode 
+  - ImagePath 
+  - ServiceName 
+  - ServiceType 
+  risk_score: 32
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_service_create_remcomsvc.test.yml b/tests/endpoint/windows_service_create_remcomsvc.test.yml
new file mode 100644
index 0000000000..9341d290fb
--- /dev/null
+++ b/tests/endpoint/windows_service_create_remcomsvc.test.yml
@@ -0,0 +1,13 @@
+name: Windows Service Create RemComSvc Unit Test
+tests:
+- name: Windows Service Create RemComSvc
+  file: endpoint/windows_service_create_remcomsvc.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: remcom_windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/remcom_windows-system.log
+    source: XmlWinEventLog:System
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

From 3fd201bda68d466d9efec9eb8f27ce22f45f903e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Mar 2023 09:38:36 -0600
Subject: [PATCH 3/9] Oktasaur

---
 ...e_and_response_for_verify_push_request.yml | 102 ++++++++++++++++++
 ...failed_requests_to_access_applications.yml |  72 +++++++++++++
 ...g_detection_with_fastpass_origin_check.yml |   2 +-
 ...kta_suspicious_use_of_a_session_cookie.yml |  67 ++++++++++++
 ..._login_failure_with_high_unknown_users.yml |   2 +-
 ...insight_suspected_passwordspray_attack.yml |   2 +-
 6 files changed, 244 insertions(+), 3 deletions(-)
 create mode 100644 detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
 create mode 100644 detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml
 create mode 100644 detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml

diff --git a/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml b/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
new file mode 100644
index 0000000000..bcc6dd46bc
--- /dev/null
+++ b/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
@@ -0,0 +1,102 @@
+name: Okta Mismatch Between Source and Response for Okta Verify Push Request
+id: 8085b79b-9b85-4e67-ad63-351c9e9a5e9a
+version: 1
+date: '2023-03-17'
+author: John Murphy and Jordan Ruocco, Okta, Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.
+  For each Okta Verify Push challenge, the following two events are recorded in Okta System Log /
+  
+  Source of Push (Sign-In) /
+
+  eventType eq "system.push.send_factor_verify_push" /
+
+  User Push Response (Okta Verify client) /
+
+  eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" /
+
+  In sequence, the logic for the analytic - /
+  
+  * Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) /
+
+  * Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. /
+  * Creates a ratio of successful sign-ins to pushes. /
+
+  * If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.'
+search: '`okta` eventType IN (system.push.send_factor_verify_push) OR
+  (eventType IN (user.authentication.auth_via_mfa)
+  debugContext.debugData.factor="OKTA_VERIFY_PUSH")
+  | eval groupby="authenticationContext.externalSessionId"
+  | eval group_push_time=_time
+  | bin span=2s group_push_time
+  | fillnull value=NULL
+  | stats min(_time) as _time by authenticationContext.externalSessionId eventType
+  debugContext.debugData.factor outcome.result actor.alternateId client.device client.ipAddress
+  client.userAgent.rawUserAgent debugContext.debugData.behaviors group_push_time groupby
+  | iplocation client.ipAddress
+  | fields - lat, lon, group_push_time
+  | stats min(_time) as _time dc(client.ipAddress) as dc_ip
+  sum(eval(if(eventType="system.push.send_factor_verify_push" AND
+  "outcome.result"="SUCCESS",1,0))) as total_pushes
+  sum(eval(if(eventType="user.authentication.auth_via_mfa" AND
+  "outcome.result"="SUCCESS",1,0))) as total_successes
+  sum(eval(if(eventType="user.authentication.auth_via_mfa" AND
+  "outcome.result"="FAILURE",1,0))) as total_rejected
+  sum(eval(if(eventType="system.push.send_factor_verify_push" AND
+  "debugContext.debugData.behaviors" LIKE "%New Device=POSITIVE%",1,0))) as suspect_device_from_source
+  sum(eval(if(eventType="system.push.send_factor_verify_push" AND
+  "debugContext.debugData.behaviors" LIKE "%New IP=POSITIVE%",0,0))) as suspect_ip_from_source
+  values(eval(if(eventType="system.push.send_factor_verify_push","client.ipAddress",""))) as src
+  values(eval(if(eventType="user.authentication.auth_via_mfa","client.ipAddress",""))) as dest
+  values(*) as * by groupby
+  | eval ratio = round(total_successes/total_pushes,2)
+  | search ((ratio < 0.5 AND total_pushes > 1) OR (total_rejected > 0)) AND dc_ip > 1 AND
+  suspect_device_from_source > 0 AND suspect_ip_from_source > 0 | `okta_mismatch_between_source_and_response_for_verify_push_request_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+known_false_positives: False positives may be present based on organization size and configuration of Okta. Monitor, tune and filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1621
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  - Okta MFA Exhaustion
+  asset_type: Infrastructure
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context: []
+  dataset: []
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A mismatch between source and response for verifying a push request has occurred for $actor.alternateId$
+  mitre_attack_id:
+  - T1621
+  nist:
+  - DE.CM
+  observable:
+  - name: actor.alternateId
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - authenticationContext.externalSessionId 
+  - eventType
+  - debugContext.debugData.factor 
+  - outcome.result 
+  - actor.alternateId 
+  - client.device 
+  - client.ipAddress
+  - client.userAgent.rawUserAgent 
+  - debugContext.debugData.behaviors 
+  - group_push_time
+  risk_score: 64
+  security_domain: access
diff --git a/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml b/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml
new file mode 100644
index 0000000000..0f20cf5db1
--- /dev/null
+++ b/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml
@@ -0,0 +1,72 @@
+name: Okta Multiple Failed Requests to Access Applications
+id: 1c21fed1-7000-4a2e-9105-5aaafa437247
+version: 1
+date: '2023-03-17'
+author: John Murphy, Okta, Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: 'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: /
+
+  * Retrieves policy evaluation and SSO details in events that contain the Application requested /
+
+  * Formats target fields so we can aggregate specifically on Applications (AppInstances) /
+
+  * Groups by User, Session and IP /
+
+  * Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies /
+
+  * Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.'
+search: '`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) 
+    | eval targets=mvzip('target{}.type', 'target{}.displayName', ": ")
+    | eval targets=mvfilter(targets LIKE "AppInstance%")
+    | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType="policy.evaluate_sign_on",targets,NULL))) as total_challenges sum(eval(if(eventType="user.authentication.sso",1,0))) as total_successes 
+    by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress
+    | search total_challenges > 0
+    | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if("outcome.result"="SUCCESS",targets,NULL))) as success_apps values(eval(if(":outcome.result"!="SUCCESS",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress
+    | fillnull
+    | eval ratio=round(total_successes/total_challenges,2), severity="HIGH", mitre_technique_id="T1538", description="actor.alternateId". " from " . "client.ipAddress" . " seen opening " . total_challenges . " chiclets/apps with " . total_successes . " challenges successfully passed"
+    | fields - count, targets
+    | search ratio < 0.5 total_challenges > 2 | `okta_multiple_failed_requests_to_access_applications_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+known_false_positives: False positives may be present based on organization size and configuration of Okta. 
+references:
+- https://attack.mitre.org/techniques/T1538
+- https://attack.mitre.org/techniques/T1550/004
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context: []
+  dataset: []
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Multiple Failed Requests to Access Applications via Okta for $actor.alternateId$.
+  mitre_attack_id:
+  - T1550.004
+  - T1538
+  nist:
+  - DE.CM
+  observable:
+  - name: actor.alternateId
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - authenticationContext.externalSessionId 
+  - targets 
+  - actor.alternateId 
+  - client.ipAddress
+  - eventType
+  risk_score: 56
+  security_domain: access
diff --git a/detections/experimental/application/okta_phishing_detection_with_fastpass_origin_check.yml b/detections/experimental/application/okta_phishing_detection_with_fastpass_origin_check.yml
index 34a9f77ecf..71ecda866d 100644
--- a/detections/experimental/application/okta_phishing_detection_with_fastpass_origin_check.yml
+++ b/detections/experimental/application/okta_phishing_detection_with_fastpass_origin_check.yml
@@ -2,7 +2,7 @@ name: Okta Phishing Detection with FastPass Origin Check
 id: f4ca0057-cbf3-44f8-82ea-4e330ee901d3
 version: 1
 date: '2023-03-09'
-author: Michael Haag, Splunk
+author: Okta, Inc, Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies.
diff --git a/detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml b/detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml
new file mode 100644
index 0000000000..a3043b8a18
--- /dev/null
+++ b/detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml
@@ -0,0 +1,67 @@
+name: Okta Suspicious Use of a Session Cookie
+id: 71ad47d1-d6bd-4e0a-b35c-020ad9a6959e
+version: 1
+date: '2023-03-17'
+author: Scott Dermott and Felicity Robson, Okta, Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: 'The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. /
+
+  * Retrieves policy evaluation events from successful authentication events. /
+
+  * Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. / 
+
+  * Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.'
+search: '`okta` eventType IN (policy.evaluate_sign_on) outcome.result IN
+  (ALLOW, SUCCESS) | stats earliest(_time) as _time values(client.ipAddress) as src_ip
+  values(client.userAgent.rawUserAgent) as user_agent values(client.userAgent.os) as
+  userAgentOS_list values(client.geographicalContext.city) as city values(client.userAgent.browser) as userAgentBrowser_list
+  values(device.os_platform) as okta_device_os dc(client.userAgent.browser) as dc_userAgentBrowser
+  dc(client.userAgent.os) as dc_userAgentOS dc(client.ipAddress) as dc_src_ip
+  values(outcome.reason) as reason by debugContext.debugData.dtHash actor.alternateId
+  | where dc_src_ip>1 AND (dc_userAgentOS>1 OR dc_userAgentBrowser>1)
+  | `okta_suspicious_use_of_a_session_cookie_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+known_false_positives: False positives may be present based on organization size and configuration of Okta. 
+references:
+  - https://attack.mitre.org/techniques/T1539/
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context: []
+  dataset: []
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A suspicious use of a session cookie was identified by user $actor.alternateId$. 
+  mitre_attack_id:
+  - T1539
+  nist:
+  - DE.CM
+  observable:
+  - name: actor.alternateId
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - client.ipAddress
+  - client.userAgent.rawUserAgent
+  - client.userAgent.os
+  - client.geographicalContext.city
+  - client.userAgent.browser
+  - device.os_platform
+  - debugContext.debugData.dtHash
+  - actor.alternateId
+  risk_score: 56
+  security_domain: access
diff --git a/detections/experimental/application/okta_threatinsight_login_failure_with_high_unknown_users.yml b/detections/experimental/application/okta_threatinsight_login_failure_with_high_unknown_users.yml
index 2fda17bb5d..c978898608 100644
--- a/detections/experimental/application/okta_threatinsight_login_failure_with_high_unknown_users.yml
+++ b/detections/experimental/application/okta_threatinsight_login_failure_with_high_unknown_users.yml
@@ -2,7 +2,7 @@ name: Okta ThreatInsight Login Failure with High Unknown users
 id: 632663b0-4562-4aad-abe9-9f621a049738
 version: 1
 date: '2023-03-09'
-author: Michael Haag, Splunk
+author: Okta, Inc, Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
diff --git a/detections/experimental/application/okta_threatinsight_suspected_passwordspray_attack.yml b/detections/experimental/application/okta_threatinsight_suspected_passwordspray_attack.yml
index fcb337b78a..8c8a24aa40 100644
--- a/detections/experimental/application/okta_threatinsight_suspected_passwordspray_attack.yml
+++ b/detections/experimental/application/okta_threatinsight_suspected_passwordspray_attack.yml
@@ -2,7 +2,7 @@ name: Okta ThreatInsight Suspected PasswordSpray Attack
 id: 25dbad05-6682-4dd5-9ce9-8adecf0d9ae2
 version: 1
 date: '2023-03-09'
-author: Michael Haag, Splunk
+author: Okta, Inc, Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.

From af080e3d138e36be94cde43213b0ad4719deb608 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Mar 2023 09:47:00 -0600
Subject: [PATCH 4/9] Delete windows_lateral_tool_transfer_remcom.yml

---
 .../windows_lateral_tool_transfer_remcom.yml  | 79 -------------------
 1 file changed, 79 deletions(-)
 delete mode 100644 detections/endpoint/windows_lateral_tool_transfer_remcom.yml

diff --git a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml b/detections/endpoint/windows_lateral_tool_transfer_remcom.yml
deleted file mode 100644
index 09043be3ed..0000000000
--- a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml
+++ /dev/null
@@ -1,79 +0,0 @@
-name: Windows Lateral Tool Transfer RemCom
-id: e373a840-5bdc-47ef-b2fd-9cc7aaf387f0
-version: 1
-date: '2023-03-20'
-author: Michael Haag, Splunk
-type: TTP
-datamodel:
-- Endpoint
-description: This analytic identifies the use of RemCom.exe - The open source psexec. This utility provides the ability to move laterally and run scripts or commands remotely.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=remcom.exe OR Processes.original_file_name=RemCom.exe) Processes.process="*\\*" Processes.process IN ("*/user:*", "*/pwd:*")
-   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_lateral_tool_transfer_remcom_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present based on Administrative use. Filter as needed.
-references:
-  - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
-  - https://github.com/kavika13/RemCom
-tags:
-  analytic_story:
-  - Active Directory Discovery
-  asset_type: Endpoint
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 50
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/remcom_windows-sysmon.log
-  impact: 80
-  kill_chain_phases:
-  - Installation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally.
-  mitre_attack_id:
-  - T1570
-  nist:
-  - DE.CM
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  risk_score: 40
-  security_domain: endpoint
\ No newline at end of file

From cb492b9c37dda286d885abc0fee10cfba639cccd Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Mar 2023 09:47:13 -0600
Subject: [PATCH 5/9] Delete windows_service_create_remcomsvc.yml

---
 .../windows_service_create_remcomsvc.yml      | 57 -------------------
 1 file changed, 57 deletions(-)
 delete mode 100644 detections/endpoint/windows_service_create_remcomsvc.yml

diff --git a/detections/endpoint/windows_service_create_remcomsvc.yml b/detections/endpoint/windows_service_create_remcomsvc.yml
deleted file mode 100644
index 2f3d2d0f35..0000000000
--- a/detections/endpoint/windows_service_create_remcomsvc.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: Windows Service Create RemComSvc
-id: 0be4b5d6-c449-4084-b945-2392b519c33b
-version: 1
-date: '2023-03-20'
-author: Michael Haag, Splunk
-type: Anomaly
-datamodel: []
-description: The following analytic identifies RemComSvc installed on an endpoint. This typically occurs when someone is moving laterally with RemCom.exe.
-search: '`wineventlog_system` EventCode=7045 ServiceName="RemCom Service" | stats count min(_time) as firstTime max(_time) as lastTime by
-  dest ImagePath ServiceName ServiceType   | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_service_create_remcomsvc_filter`'
-how_to_implement: To implement this analytic, the Windows EventCode 7045 will need to be logged. The Windows TA for Splunk is also recommended.
-known_false_positives: False positives may be present, filter as needed based on administrative activity.
-references:
-  - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
-  - https://github.com/kavika13/RemCom
-tags:
-  analytic_story:
-  - Active Directory Discovery
-  asset_type: Endpoint
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 80
-  context:
-  - Source:Endpoint
-  - Stage:Persistence
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/remcom_windows-system.log
-  impact: 40
-  kill_chain_phases:
-  - Installation
-  message:  A new service was created related to RemCom on $dest$.
-  mitre_attack_id:
-  - T1543.003
-  - T1543
-  nist:
-  - DE.CM
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest 
-  - EventCode 
-  - ImagePath 
-  - ServiceName 
-  - ServiceType 
-  risk_score: 32
-  security_domain: endpoint

From 9cedba5456ed40f43cdf62d3caac7d2151032b98 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Mar 2023 09:47:32 -0600
Subject: [PATCH 6/9] Delete windows_lateral_tool_transfer_remcom.test.yml

---
 .../windows_lateral_tool_transfer_remcom.test.yml   | 13 -------------
 1 file changed, 13 deletions(-)
 delete mode 100644 tests/endpoint/windows_lateral_tool_transfer_remcom.test.yml

diff --git a/tests/endpoint/windows_lateral_tool_transfer_remcom.test.yml b/tests/endpoint/windows_lateral_tool_transfer_remcom.test.yml
deleted file mode 100644
index e2a3f3d374..0000000000
--- a/tests/endpoint/windows_lateral_tool_transfer_remcom.test.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-name: Windows Lateral Tool Transfer RemCom Unit Test
-tests:
-- name: Windows Lateral Tool Transfer RemCom
-  file: endpoint/windows_lateral_tool_transfer_remcom.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -24h
-  latest_time: now
-  attack_data:
-  - file_name: remcom_windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/remcom_windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
-    update_timestamp: true

From ecf698442fcd7bbdc9e87ec41a1c7bb5703418d3 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Mar 2023 09:48:04 -0600
Subject: [PATCH 7/9] Delete windows_service_create_remcomsvc.test.yml

---
 .../windows_service_create_remcomsvc.test.yml       | 13 -------------
 1 file changed, 13 deletions(-)
 delete mode 100644 tests/endpoint/windows_service_create_remcomsvc.test.yml

diff --git a/tests/endpoint/windows_service_create_remcomsvc.test.yml b/tests/endpoint/windows_service_create_remcomsvc.test.yml
deleted file mode 100644
index 9341d290fb..0000000000
--- a/tests/endpoint/windows_service_create_remcomsvc.test.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-name: Windows Service Create RemComSvc Unit Test
-tests:
-- name: Windows Service Create RemComSvc
-  file: endpoint/windows_service_create_remcomsvc.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -24h
-  latest_time: now
-  attack_data:
-  - file_name: remcom_windows-system.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/remcom_windows-system.log
-    source: XmlWinEventLog:System
-    sourcetype: XmlWinEventLog
-    update_timestamp: true

From 2b91b38919f15ad35bf845a3d316a4a6ddae0d39 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 21 Mar 2023 11:19:44 -0500
Subject: [PATCH 8/9] yaml fixes

---
 ...n_source_and_response_for_verify_push_request.yml |  2 +-
 ...ltiple_failed_requests_to_access_applications.yml | 12 +-----------
 2 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml b/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
index bcc6dd46bc..2b3fead586 100644
--- a/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
+++ b/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
@@ -1,4 +1,4 @@
-name: Okta Mismatch Between Source and Response for Okta Verify Push Request
+name: Okta Mismatch Between Source and Response for Verify Push Request
 id: 8085b79b-9b85-4e67-ad63-351c9e9a5e9a
 version: 1
 date: '2023-03-17'
diff --git a/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml b/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml
index 0f20cf5db1..303ae3d3f0 100644
--- a/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml
+++ b/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml
@@ -16,17 +16,7 @@ description: 'The following analytic identifies multiple failed app requests in
   * Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies /
 
   * Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.'
-search: '`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) 
-    | eval targets=mvzip('target{}.type', 'target{}.displayName', ": ")
-    | eval targets=mvfilter(targets LIKE "AppInstance%")
-    | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType="policy.evaluate_sign_on",targets,NULL))) as total_challenges sum(eval(if(eventType="user.authentication.sso",1,0))) as total_successes 
-    by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress
-    | search total_challenges > 0
-    | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if("outcome.result"="SUCCESS",targets,NULL))) as success_apps values(eval(if(":outcome.result"!="SUCCESS",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress
-    | fillnull
-    | eval ratio=round(total_successes/total_challenges,2), severity="HIGH", mitre_technique_id="T1538", description="actor.alternateId". " from " . "client.ipAddress" . " seen opening " . total_challenges . " chiclets/apps with " . total_successes . " challenges successfully passed"
-    | fields - count, targets
-    | search ratio < 0.5 total_challenges > 2 | `okta_multiple_failed_requests_to_access_applications_filter`'
+search: '`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip("target{}.type", "target{}.displayName", ": ") | eval targets=mvfilter(targets LIKE "AppInstance%") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType="policy.evaluate_sign_on",targets,NULL))) as total_challenges sum(eval(if(eventType="user.authentication.sso",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0  | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if("outcome.result"="SUCCESS",targets,NULL))) as success_apps values(eval(if(":outcome.result"!="SUCCESS",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity="HIGH", mitre_technique_id="T1538", description="actor.alternateId". " from " . "client.ipAddress" . " seen opening " . total_challenges . " chiclets/apps with " . total_successes . " challenges successfully passed" | fields - count, targets | search ratio < 0.5 total_challenges > 2 | `okta_multiple_failed_requests_to_access_applications_filter`'
 how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
 known_false_positives: False positives may be present based on organization size and configuration of Okta. 
 references:

From 032a8045097f4ac15a07f31ab39e576ae2d69489 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 21 Mar 2023 13:52:04 -0500
Subject: [PATCH 9/9] pita

---
 .../okta_multiple_failed_requests_to_access_applications.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml b/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml
index 303ae3d3f0..47b34c2ee8 100644
--- a/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml
+++ b/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml
@@ -16,7 +16,7 @@ description: 'The following analytic identifies multiple failed app requests in
   * Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies /
 
   * Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.'
-search: '`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip("target{}.type", "target{}.displayName", ": ") | eval targets=mvfilter(targets LIKE "AppInstance%") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType="policy.evaluate_sign_on",targets,NULL))) as total_challenges sum(eval(if(eventType="user.authentication.sso",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0  | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if("outcome.result"="SUCCESS",targets,NULL))) as success_apps values(eval(if(":outcome.result"!="SUCCESS",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity="HIGH", mitre_technique_id="T1538", description="actor.alternateId". " from " . "client.ipAddress" . " seen opening " . total_challenges . " chiclets/apps with " . total_successes . " challenges successfully passed" | fields - count, targets | search ratio < 0.5 total_challenges > 2 | `okta_multiple_failed_requests_to_access_applications_filter`'
+search: "`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip('target{}.type', 'target{}.displayName', \": \") | eval targets=mvfilter(targets LIKE \"AppInstance%\") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType=\"policy.evaluate_sign_on\",targets,NULL))) as total_challenges sum(eval(if(eventType=\"user.authentication.sso\",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if(\"outcome.result\"=\"SUCCESS\",targets,NULL))) as success_apps values(eval(if(\":outcome.result\"!=\"SUCCESS\",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity=\"HIGH\", mitre_technique_id=\"T1538\", description=\"actor.alternateId\". \" from \" . \"client.ipAddress\" . \" seen opening \" . total_challenges . \" chiclets/apps with \" . total_successes . \" challenges successfully passed\" | fields - count, targets | search ratio < 0.5 total_challenges > 2` | okta_multiple_failed_requests_to_access_applications_filter`"
 how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
 known_false_positives: False positives may be present based on organization size and configuration of Okta. 
 references: