From f9109fb372a339b9eff77ad8e2567dd7abb2734d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 15 Jul 2022 10:01:42 -0600
Subject: [PATCH 1/5] Update powershell_disable_security_monitoring.yml

---
 .../endpoint/powershell_disable_security_monitoring.yml    | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml
index 3e74f365d1..f8e32a1f94 100644
--- a/detections/endpoint/powershell_disable_security_monitoring.yml
+++ b/detections/endpoint/powershell_disable_security_monitoring.yml
@@ -1,7 +1,7 @@
 name: Powershell Disable Security Monitoring
 id: c148a894-dd93-11eb-bf2a-acde48001122
-version: 2
-date: '2021-07-05'
+version: 3
+date: '2022-07-15'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -11,7 +11,7 @@ description: This search is to identifies a modification in registry to disable
   seen in RAT, bot, or Trojan to disable AV to evade detections.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*"
-  AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*")
+  AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*","*DisableBehaviorMonitoring*","*drtm *","*dioavp *","*dscrptsc *","*dbaf *","*dbm *")
   by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -25,6 +25,7 @@ known_false_positives: Limited false positives. However, tune based on scripts t
   may perform this action.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell
+- https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps
 tags:
   analytic_story:
   - Ransomware

From b71e57089174b83d4c3e6388e5c814328a520cc5 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 15 Jul 2022 10:16:14 -0600
Subject: [PATCH 2/5] Update cobalt_strike_named_pipes.yml

Updated to Hunting
---
 .../detections/cobalt_strike_named_pipes.yml              | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_data_output/detections/cobalt_strike_named_pipes.yml b/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_data_output/detections/cobalt_strike_named_pipes.yml
index 8cea32f024..0b6a2bf0c6 100644
--- a/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_data_output/detections/cobalt_strike_named_pipes.yml
+++ b/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_data_output/detections/cobalt_strike_named_pipes.yml
@@ -1,9 +1,9 @@
 name: Cobalt Strike Named Pipes
 id: 5876d429-0240-4709-8b93-ea8330b411b5
-version: 1
-date: '2021-02-22'
-author: MICHAEL HAAG, SPLUNK
-type: TTP
+version: 2
+date: '2022-07-15'
+author: Michael Haag, Splunk
+type: Hunting
 datamodel: []
 description: 'The following analytic identifies the use of default or publicly known
   named pipes used with Cobalt Strike. A named pipe is a named, one-way or duplex

From 6d9d7b1a57aa85db7fa1895da2c16266aa79e54d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 15 Jul 2022 10:21:56 -0600
Subject: [PATCH 3/5] Update certutil_exe_certificate_extraction.yml

updated query and references
---
 .../certutil_exe_certificate_extraction.yml    | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml
index eaf6ec2b1c..186b04b778 100644
--- a/detections/endpoint/certutil_exe_certificate_extraction.yml
+++ b/detections/endpoint/certutil_exe_certificate_extraction.yml
@@ -1,7 +1,7 @@
 name: Certutil exe certificate extraction
 id: 337a46be-600f-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-26'
+version: 2
+date: '2022-07-15'
 author: Rod Soto, Splunk
 type: TTP
 datamodel:
@@ -9,18 +9,20 @@ datamodel:
 description: This search looks for arguments to certutil.exe indicating the manipulation
   or extraction of Certificate. This certificate can then be used to sign new authentication
   tokens specially inside Federated environments such as Windows ADFS.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
-  Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `certutil_exe_certificate_extraction_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `certutil_exe_certificate_extraction_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
 known_false_positives: Unless there are specific use cases, manipulating or exporting
   certificates using certutil is uncommon. Extraction of certificate has been observed
   during attacks such as Golden SAML and other campaigns targeting Federated services.
-references: []
+references:
+  - https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack
+  - https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html
 tags:
   analytic_story:
   - Windows Persistence Techniques

From 5aaca9254587e25467456f39b46c5ed0ffa90a35 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 19 Jul 2022 06:07:01 -0600
Subject: [PATCH 4/5] MOFComp

---
 ..._mof_event_triggered_execution_via_wmi.yml | 85 +++++++++++++++++++
 ...event_triggered_execution_via_wmi.test.yml | 13 +++
 2 files changed, 98 insertions(+)
 create mode 100644 detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
 create mode 100644 tests/endpoint/windows_mof_event_triggered_execution_via_wmi.test.yml

diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
new file mode 100644
index 0000000000..3826d29f57
--- /dev/null
+++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
@@ -0,0 +1,85 @@
+name: Windows MOF Event Triggered Execution via WMI
+id: e59b5a73-32bf-4467-a585-452c36ae10c1
+version: 1
+date: '2022-07-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following anaytic identifies MOFComp.exe loading a local or remote MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. 
+  Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths.
+  The default path of mofcomp.exe is C:\Windows\System32\wbem. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where 
+  (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) 
+  OR (Processes.process_name=mofcomp.exe Processes.process IN ("*http:*", "*https:*") 
+  OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) 
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_mof_event_triggered_execution_via_wmi_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or f
+references:
+  - https://attack.mitre.org/techniques/T1546/003/
+  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
+  - https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ loading a MOF file.
+  mitre_attack_id:
+  - T1546.003
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/windows_mof_event_triggered_execution_via_wmi.test.yml b/tests/endpoint/windows_mof_event_triggered_execution_via_wmi.test.yml
new file mode 100644
index 0000000000..2d1dcaa4b2
--- /dev/null
+++ b/tests/endpoint/windows_mof_event_triggered_execution_via_wmi.test.yml
@@ -0,0 +1,13 @@
+name: Windows MOF Event Triggered Execution via WMI Unit Test
+tests:
+- name: Windows MOF Event Triggered Execution via WMI
+  file: endpoint/windows_mof_event_triggered_execution_via_wmi.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: mofcomp.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 9e36b6652ca844a1ce8437003a95d8c2d3c20bcb Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 19 Jul 2022 08:03:48 -0600
Subject: [PATCH 5/5] Update windows_mof_event_triggered_execution_via_wmi.yml

---
 .../windows_mof_event_triggered_execution_via_wmi.yml     | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
index 3826d29f57..d8d851af0f 100644
--- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
+++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
@@ -6,13 +6,13 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following anaytic identifies MOFComp.exe loading a local or remote MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. 
-  Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths.
+description: The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. 
+  Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. 
+  A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts.
   The default path of mofcomp.exe is C:\Windows\System32\wbem. 
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where 
   (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) 
-  OR (Processes.process_name=mofcomp.exe Processes.process IN ("*http:*", "*https:*") 
   OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) 
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` 
@@ -25,6 +25,8 @@ references:
   - https://attack.mitre.org/techniques/T1546/003/
   - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
   - https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
+  - https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/
+  - https://www.sakshamdixit.com/wmi-events/
 tags:
   analytic_story:
   - Living Off The Land