update logic

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml

@@ -1,12 +1,12 @@
 name: CertUtil Download With URLCache and Split Arguments
 id: 415b4306-8bfb-11eb-85c4-acde48001122
 version: '8'
-date: '2024-12-03'
+date: '2024-12-07'
 author: Michael Haag, Splunk
 status: production
 type: TTP
 description: The following analytic detects the use of certutil.exe to download files
-  using the `-urlcache` and `-split` arguments. It leverages Endpoint Detection and
+  using the `-urlcache` and `-f` arguments. It leverages Endpoint Detection and
   Response (EDR) data, focusing on command-line executions that include these specific
   arguments. This activity is significant because certutil.exe is typically used for
   certificate services, and its use to download files from remote locations is uncommon
@@ -18,8 +18,8 @@ data_source:
 - Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache*
-  Processes.process=*split*) by Processes.dest Processes.user
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*urlcache*
+  (Processes.process=*/f * or Processes.process=*-f *) by Processes.dest Processes.user
   Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.original_file_name Processes.parent_process_id |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -39,6 +39,7 @@ references:
 - https://attack.mitre.org/techniques/T1105/
 - https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
 - https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
+- https://lolbas-project.github.io/lolbas/Binaries/Certutil/
 drilldown_searches:
 - name: View the detection results for - "$user$" and "$dest$"
   search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'

detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml

@@ -1,12 +1,12 @@
 name: CertUtil Download With VerifyCtl and Split Arguments
 id: 801ad9e4-8bfb-11eb-8b31-acde48001122
-version: '7'
-date: '2024-11-28'
+version: '8'
+date: '2024-12-07'
 author: Michael Haag, Splunk
 status: production
 type: TTP
 description: The following analytic detects the use of `certutil.exe` to download
-  files using the `-VerifyCtl` and `-split` arguments. This behavior is identified
+  files using the `-VerifyCtl` and `-f` arguments. This behavior is identified
   by monitoring command-line executions for these specific arguments via Endpoint
   Detection and Response (EDR) telemetry. This activity is significant because `certutil.exe`
   is a legitimate tool often abused by attackers to download and execute malicious
@@ -18,8 +18,8 @@ data_source:
 - Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl*
-  Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*verifyctl*
+  (Processes.process=*/f * OR Processes.process=*-f *) by Processes.dest Processes.user
   Processes.original_file_name Processes.parent_process Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -40,6 +40,7 @@ references:
 - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
 - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
 - https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+- https://lolbas-project.github.io/lolbas/Binaries/Certutil/
 drilldown_searches:
 - name: View the detection results for - "$user$" and "$dest$"
   search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'