Added detection testing service results inSchCache Change By App Connect And Create ADSI Object

detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml

@@ -6,24 +6,29 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect an application try to connect and create ADSI Object to do LDAP query.
-  Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. 
-  If it has changed since the last connection, the schema is downloaded and stored in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache.
-  We found this a good anomaly use case to detect suspicious application like blackmatter ransomware that use ADS object api to execute ldap query.
-  having a good list of ldap or normal AD query tool used within the network is a good start to reduce the noise.
-search: '`sysmon` EventCode=11  TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe"))
-  |stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id  process_name Computer 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+description: This analytic is to detect an application try to connect and create ADSI
+  Object to do LDAP query. Every time an application connects to the directory and
+  attempts to create an ADSI object, the Active Directory Schema is checked for changes.
+  If it has changed since the last connection, the schema is downloaded and stored
+  in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache
+  or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious
+  application like blackmatter ransomware that use ADS object api to execute ldap
+  query. having a good list of ldap or normal AD query tool used within the network
+  is a good start to reduce the noise.
+search: '`sysmon` EventCode=11  TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename
+  = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) |stats count min(_time)
+  as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id  process_name
+  Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `schcache_change_by_app_connect_and_create_adsi_object_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: normal application like mmc.exe and other ldap query tool may trigger this detections.
+  Sysmon TA.
+known_false_positives: normal application like mmc.exe and other ldap query tool may
+  trigger this detections.
 references:
--  https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac
--  https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 tags:
   analytic_story:
   - blackMatter ransomware
@@ -39,23 +44,23 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Image 
-  - TargetFilename 
-  - EventCode 
-  - process_id 
-  - process_name 
-  - Computer 
+  - Image
+  - TargetFilename
+  - EventCode
+  - process_id
+  - process_name
+  - Computer
   security_domain: endpoint
   impact: 50
   confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
   context:
-    - source:endpoint
-    - stage:Discovery
+  - source:endpoint
+  - stage:Discovery
   message: process $Image$ create a file $TargetFilename$ in host $Computer$
   observable:
   - name: Computer
     type: Hostname
     role:
-    - Victim
+    - Victim
+  automated_detection_testing: passed