Branch was auto-updated.

bin/docker_detection_tester/modules/validate_args.py

@@ -144,6 +144,11 @@ setup_schema = {
                     "app_version": "8.1.0",
                     "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz"
                   },
+                  "SPLUNK_TA_FIX_WINDOWS":{
+                    "app_number": 9999,
+                    "app_version": "1.0.0",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz"
+                  },
                   "SPLUNK_COMMON_INFORMATION_MODEL": {
                     "app_number": 1621,
                     "app_version": "5.0.1",
@@ -371,4 +376,4 @@ def validate(configuration: dict, skip_password_accessibility_check: bool = True
     except Exception as e:
         print("There was an error validation the configuration: [%s]" % (
             str(e)), file=sys.stderr)
-        return None, setup_schema
+        return None, setup_schema

bin/docker_detection_tester/test_config_github_actions.json

@@ -65,6 +65,11 @@
         "app_version": "8.1.0",
         "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz"
       },
+      "SPLUNK_TA_FIX_WINDOWS":{
+        "app_number": 9999,
+        "app_version": "1.0.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz"
+      },
       "SPLUNK_COMMON_INFORMATION_MODEL": {
         "app_number": 1621,
         "app_version": "5.0.1",

detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml

@@ -0,0 +1,75 @@
+name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
+id: 98f22d82-9d62-11eb-9fcf-acde48001122
+version: 2
+date: '2021-04-14'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies one source endpoint failing to authenticate
+  with 30 unique disabled domain users using the Kerberos protocol within 5 minutes. This behavior could
+  represent an adversary performing a Password Spraying attack against an Active Directory
+  environment using Kerberos to obtain initial access or elevate privileges. 
+  Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
+  As attackers
+  progress in a breach, mistakes will be made. In certain scenarios, adversaries may
+  execute a password spraying attack against disabled users. Event 4768 is generated
+  every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket
+  (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account
+  disabled, expired or locked out).\
+
+  This logic can be used for real time security monitoring as well as threat hunting exercises.
+  This detection will only trigger on domain controllers, not on member servers or workstations.\
+
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source ip and attempted user accounts.'
+search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12
+  | bucket span=5m _time 
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
+  | where unique_accounts > 30 
+  | `windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: A host failing to authenticate with multiple disabled domain
+  users is not a common behavior for legitimate systems. Possible false positive scenarios
+  include but are not limited to vulnerability scanners, multi-user systems missconfigured
+  systems.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+tags:
+  analytic_story:
+  - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Potential Kerberos based password spraying attack from $IpAddress$
+  mitre_attack_id:
+  - T1110.003
+  - T1110
+  observable:
+  - name: IpAddress
+    type: Endpoint
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Status
+  - TargetUserName
+  - IpAddress
+  risk_score: 49
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml

@@ -0,0 +1,76 @@
+name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
+id: 001266a6-9d5b-11eb-829b-acde48001122
+version: 2
+date: '2021-04-14'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies one source endpoint failing to authenticate
+  with 30 unique invalid domain users using the Kerberos protocol. This behavior could
+  represent an adversary performing a Password Spraying attack against an Active Directory
+  environment using Kerberos to obtain initial access or elevate privileges. 
+  Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
+  As attackers
+  progress in a breach, mistakes will be made. In certain scenarios, adversaries may
+  execute a password spraying attack using an invalid list of users. Event 4768 is
+  generated every time the Key Distribution Center issues a Kerberos Ticket Granting
+  Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database`
+  (the attempted user is not a valid domain user).\
+
+  This logic can be used for real time security monitoring as well as threat hunting exercises.
+  This detection will only trigger on domain controllers, not on member servers or
+  workstations.\
+
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source ip and attempted user accounts.'
+search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6
+  | bucket span=5m _time 
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
+  | where unique_accounts > 30 
+  | `windows_multiple_invalid_users_fail_to_authenticate_using_kerberos_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: A host failing to authenticate with multiple invalid domain
+  users is not a common behavior for legitimate systems. Possible false positive scenarios
+  include but are not limited to vulnerability scanners, multi-user systems and missconfigured
+  systems.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+tags:
+  analytic_story:
+  - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Potential Kerberos based password spraying attack from $IpAddress$
+  mitre_attack_id:
+  - T1110.003
+  - T1110
+  observable:
+  - name: IpAddress
+    type: Endpoint
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Status
+  - TargetUserName
+  - IpAddress
+  risk_score: 49
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml

@@ -0,0 +1,78 @@
+name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM
+id: 57ad5a64-9df7-11eb-a290-acde48001122
+version: 2
+date: '2021-04-15'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies one source endpoint failing to authenticate
+  with 30 unique invalid users using the NTLM protocol. This behavior could represent
+  an adversary performing a Password Spraying attack against an Active Directory environment
+  using NTLM to obtain initial access or elevate privileges. 
+  Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
+  As attackers progress
+  in a breach, mistakes will be made. In certain scenarios, adversaries may execute
+  a password spraying attack using an invalid list of users. Event 4776 is generated
+  on the computer that is authoritative for the provided credentials. For domain accounts,
+  the domain controller is authoritative. For local accounts, the local computer is
+  authoritative. Error code 0xC0000064 stands for `The username you typed does not
+  exist` (the attempted user is a legitimate domain user).\
+
+  This logic can be used for real time security monitoring as well as threat hunting exercises.
+  This detection will only trigger on domain controllers, not on member servers or
+  workstations.\
+
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source workstation name and attempted user accounts.'
+search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064
+  | bucket span=5m _time 
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
+  | where unique_accounts > 30 
+  | `windows_multiple_invalid_users_failed_to_authenticate_using_ntlm_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
+  Validation' within `Account Logon` needs to be enabled.
+known_false_positives: A host failing to authenticate with multiple invalid domain
+  users is not a common behavior for legitimate systems. Possible false positive scenarios
+  include but are not limited to vulnerability scanners and missconfigured systems.
+  If this detection triggers on a host other than a Domain Controller, the behavior
+  could represent a password spraying attack against the host's local accounts.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
+tags:
+  analytic_story:
+  - Active Directory Password Spraying
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Potential NTLM based password spraying attack from $Workstation$
+  mitre_attack_id:
+  - T1110.003
+  - T1110
+  observable:
+  - name: Workstation
+    type: Endpoint
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetUserName
+  - Workstation
+  - Status
+  risk_score: 49
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml

@@ -0,0 +1,78 @@
+name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials
+id: e61918fa-9ca4-11eb-836c-acde48001122
+version: 2
+date: '2021-04-13'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies a source user failing to authenticate
+  with 30 unique users using explicit credentials on a host. This behavior could represent
+  an adversary performing a Password Spraying attack against an Active Directory environment
+  to obtain initial access or elevate privileges. 
+  Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
+  Event 4648 is generated when a process
+  attempts an account logon by explicitly specifying that accounts credentials. This
+  event generates on domain controllers, member servers, and workstations.\
+
+  This logic can be used for real time security monitoring as well as threat hunting exercises.
+  This detection will trigger on the potenfially malicious host, perhaps controlled
+  via a trojan or operated by an insider threat, from where a password spraying attack
+  is being executed.\
+
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source account, attempted user accounts and the endpoint were
+  the behavior was identified.'
+search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$
+  | bucket span=5m _time 
+  | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as  tried_account by _time, Computer, Caller_User_Name
+  | where unique_accounts > 30
+  | `windows_multiple_users_fail_to_authenticate_wth_explicitcredentials_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers as well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+known_false_positives: A source user failing attempting to authenticate multiple users
+  on a host is not a common behavior for regular systems. Some applications, however,
+  may exhibit this behavior in which case sets of users hosts can be added to an allow
+  list. Possible false positive scenarios include systems where several users connect
+  to like Mail servers, identity providers, remote desktop services, Citrix, etc.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
+tags:
+  analytic_story:
+  - Active Directory Password Spraying
+  - Insider Threat
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Potential password spraying attack from $Computer$
+  mitre_attack_id:
+  - T1110.003
+  - T1110
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Target_User_Name
+  - Caller_User_Name
+  - Computer
+  risk_score: 49
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml

@@ -0,0 +1,76 @@
+name: Windows Multiple Users Failed To Authenticate From Host Using NTLM
+id: 7ed272a4-9c77-11eb-af22-acde48001122
+version: 2
+date: '2021-04-13'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies one source endpoint failing to authenticate
+  with 30 unique valid users using the NTLM protocol. This behavior could represent
+  an adversary performing a Password Spraying attack against an Active Directory environment
+  using NTLM to obtain initial access or elevate privileges. 
+  Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
+  Event 4776 is generated
+  on the computer that is authoritative for the provided credentials. For domain accounts,
+  the domain controller is authoritative. For local accounts, the local computer is
+  authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted
+  user is a legitimate domain user).\
+
+  This logic can be used for real time security monitoring as well as threat hunting exercises.
+  This detection will only trigger on domain controllers, not on member servers or
+  workstations.\
+
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source workstation name and attempted user accounts.'
+search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A
+  | bucket span=5m _time 
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
+  | where unique_accounts > 30
+  | `windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
+  Validation` within `Account Logon` needs to be enabled.
+known_false_positives: A host failing to authenticate with multiple valid domain users
+  is not a common behavior for legitimate systems. Possible false positive scenarios
+  include but are not limited to vulnerability scanners and missconfigured systems.
+  If this detection triggers on a host other than a Domain Controller, the behavior
+  could represent a password spraying attack against the host's local accounts.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
+tags:
+  analytic_story:
+  - Active Directory Password Spraying
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Potential NTLM based password spraying attack from $Workstation$
+  mitre_attack_id:
+  - T1110.003
+  - T1110
+  observable:
+  - name: Workstation
+    type: Endpoint
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Status
+  - TargetUserName
+  - Workstation
+  risk_score: 49
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml

@@ -0,0 +1,79 @@
+name: Windows Multiple Users Failed To Authenticate From Process
+id: 9015385a-9c84-11eb-bef2-acde48001122
+version: 2
+date: '2021-04-13'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies a source process name failing to authenticate
+  with 30 uniquer users. This behavior could represent an adversary performing a Password
+  Spraying attack against an Active Directory environment to obtain initial access
+  or elevate privileges. 
+  Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
+  Event 4625 generates on domain controllers, member servers,
+  and workstations when an account fails to logon. Logon Type 2 describes an iteractive
+  logon attempt.\
+
+  This logic can be used for real time security monitoring as well as threat hunting exercises.
+  This detection will trigger on the potenfially malicious host, perhaps controlled
+  via a trojan or operated by an insider threat, from where a password spraying attack
+  is being executed. This could be a domain controller as well as a member server
+  or workstation.\
+
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source process name, source account and attempted user accounts.'
+search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-"
+ | bucket span=5m _time
+ | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer
+ | where unique_accounts > 30
+ | `windows_multiple_users_failed_to_authenticate_from_process_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers aas well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+known_false_positives: A process failing to authenticate with multiple users is not
+  a common behavior for legitimate user sessions. Possible false positive scenarios
+  include but are not limited to vulnerability scanners and missconfigured systems.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
+- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
+tags:
+  analytic_story:
+  - Active Directory Password Spraying
+  - Insider Threat
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Potential password spraying attack from $Computer$
+  mitre_attack_id:
+  - T1110.003
+  - T1110
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Logon_Type
+  - ProcessName
+  - SubjectUserName
+  - TargetUserName
+  - Computer
+  risk_score: 49
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml

@@ -0,0 +1,76 @@
+name: Windows Multiple Users Failed To Authenticate Using Kerberos
+id: 3a91a212-98a9-11eb-b86a-acde48001122
+version: 2
+date: '2021-04-08'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies one source endpoint failing to authenticate
+  with 30 unique users using the Kerberos protocol. This behavior could represent
+  an adversary performing a Password Spraying attack against an Active Directory environment
+  using Kerberos to obtain initial access or elevate privileges. 
+  Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
+  Event 4771 is generated
+  when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket
+  (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user
+  is a legitimate domain user).\
+
+  This logic can be used for real time security monitoring as well as threat hunting exercises.
+  This detection will only trigger on domain controllers, not on member servers or
+  workstations.\
+
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source ip and attempted user accounts.'
+search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18
+  | bucket span=5m _time 
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
+  | where unique_accounts > 30 
+  | `windows_multiple_users_failed_to_authenticate_using_kerberos_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: A host failing to authenticate with multiple valid domain users
+  is not a common behavior for legitimate systems. Possible false positive scenarios
+  include but are not limited to vulnerability scanners, missconfigured systems and
+  multi-user systems like Citrix farms.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319109(v=ws.11)
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771
+tags:
+  analytic_story:
+  - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Potential Kerberos based password spraying attack from $IpAddress$
+  mitre_attack_id:
+  - T1110.003
+  - T1110
+  observable:
+  - name: IpAddress
+    type: Endpoint
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Status
+  - TargetUserName
+  - IpAddress
+  risk_score: 49
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml

@@ -0,0 +1,77 @@
+name: Windows Multiple Users Remotely Failed To Authenticate From Host
+id: 80f9d53e-9ca1-11eb-b0d6-acde48001122
+version: 2
+date: '2021-04-13'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies a source host failing to authenticate
+  against a remote host with 30 unique users. This behavior could represent an adversary
+  performing a Password Spraying attack against an Active Directory environment to
+  obtain initial access or elevate privileges. 
+  Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
+  Event 4625 documents each and every
+  failed attempt to logon to the local computer. This event generates on domain controllers,
+  member servers, and workstations. Logon Type 3 describes an remote authentication
+  attempt.\
+
+  This logic can be used for real time security monitoring as well as threat hunting exercises.
+  This detection will trigger on the host that is the target of the password spraying
+  attack. This could be a domain controller as well as a member server or workstation.\
+
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source process name, source account and attempted user accounts.'
+search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-"
+  | bucket span=5m _time 
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer
+  | where unique_accounts > 30 
+  | `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers as as well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+known_false_positives: A host failing to authenticate with multiple valid users against
+  a remote host is not a common behavior for legitimate systems. Possible false positive
+  scenarios include but are not limited to vulnerability scanners, remote administration
+  tools, missconfigyred systems, etc.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
+- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
+tags:
+  analytic_story:
+  - Active Directory Password Spraying
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Potential password spraying attack on $ComputerName$
+  mitre_attack_id:
+  - T1110.003
+  - T1110
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Logon_Type
+  - TargetUserName
+  - Computer
+  - IpAddress
+  risk_score: 49
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml

@@ -1,7 +1,7 @@
-name: Windows Disabled Users Failing To Authenticate Kerberos
-id: 98f22d82-9d62-11eb-9fcf-acde48001122
+name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos
+id: f65aa026-b811-42ab-b4b9-d9088137648f
 version: 1
-date: '2021-04-14'
+date: '2022-09-22'
 author: Mauricio Velazco, Splunk
 type: Anomaly
 datamodel: []
@@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a
 
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source ip and attempted user accounts.'
-search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12
-  | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
-  as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
-  comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
+search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12
+  | bucket span=5m _time
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
+  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress 
+  | eval upperBound=(comp_avg+comp_std*3)
   | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
-  | search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` '
+  | search isOutlier=1 
+  | `windows_unusual_count_of_disabled_users_failed_auth_using_kerberos_filter` '
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting
   `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
@@ -52,19 +54,19 @@ tags:
   - Stage:Initial Access
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Potential Kerberos based password spraying attack from $Client_Address$
+  message: Potential Kerberos based password spraying attack from $IpAddress$
   mitre_attack_id:
   - T1110.003
   - T1110
   observable:
-  - name: Client_Address
+  - name: IpAddress
     type: Endpoint
     role:
-    - Victim
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -72,9 +74,9 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Result_Code
-  - Account_Name
-  - Client_Address
+  - Status
+  - TargetUserName
+  - IpAddress
   risk_score: 49
   security_domain: endpoint
   asset_type: Endpoint

detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml

@@ -1,7 +1,7 @@
-name: Windows Invalid Users Failed Authentication via Kerberos
-id: 001266a6-9d5b-11eb-829b-acde48001122
+name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos
+id: f122cb2e-d773-4f11-8399-62a3572d8dd7
 version: 1
-date: '2021-04-14'
+date: '2022-09-22'
 author: Mauricio Velazco, Splunk
 type: Anomaly
 datamodel: []
@@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a
 
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source ip and attempted user accounts.'
-search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$"
-  | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
-  as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
-  comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
+search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6
+  | bucket span=5m _time
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
+  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress 
+  | eval upperBound=(comp_avg+comp_std*3)
   | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
-  | search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` '
+  | search isOutlier=1 
+  | `windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos_filter` '
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting
   `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
@@ -52,19 +54,19 @@ tags:
   - Stage:Initial Access
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Potential Kerberos based password spraying attack from $Client_Address$
+  message: Potential Kerberos based password spraying attack from $IpAddress$
   mitre_attack_id:
   - T1110.003
   - T1110
   observable:
-  - name: Client_Address
+  - name: IpAddress
     type: Endpoint
     role:
-    - Victim
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -72,9 +74,9 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Result_Code
-  - Account_Name
-  - Client_Address
+  - Status
+  - TargetUserName
+  - IpAddress
   risk_score: 49
   security_domain: endpoint
   asset_type: Endpoint

detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml

@@ -1,7 +1,7 @@
-name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM
-id: 57ad5a64-9df7-11eb-a290-acde48001122
+name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM
+id: 15603165-147d-4a6e-9778-bd0ff39e668f
 version: 1
-date: '2021-04-15'
+date: '2022-09-22'
 author: Mauricio Velazco, Splunk
 type: Anomaly
 datamodel: []
@@ -27,12 +27,14 @@ description: 'The following analytic identifies one source endpoint failing to a
 
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source workstation name and attempted user accounts.'
-search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure
-  | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account)
-  as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts)
-  as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3)
+search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064
+  | bucket span=2m _time 
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
+  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation
+  | eval upperBound=(comp_avg+comp_std*3)
   | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
-  | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`'
+  | search isOutlier=1 
+  | `windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
   Validation' within `Account Logon` needs to be enabled.
@@ -54,7 +56,7 @@ tags:
   - Stage:Initial Access
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
@@ -63,10 +65,10 @@ tags:
   - T1110.003
   - T1110
   observable:
-  - name: Source_Workstation
+  - name: Workstation
     type: Endpoint
     role:
-    - Victim
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -74,9 +76,9 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - action
-  - Logon_Account
-  - Source_Workstation
+  - TargetUserName
+  - Workstation
+  - Status
   risk_score: 49
   security_domain: endpoint
   asset_type: Endpoint

detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml

@@ -1,7 +1,7 @@
-name: Windows Users Authenticate Using Explicit Credentials
-id: e61918fa-9ca4-11eb-836c-acde48001122
+name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials
+id: 14f414cf-3080-4b9b-aaf6-55a4ce947b93
 version: 1
-date: '2021-04-13'
+date: '2022-09-22'
 author: Mauricio Velazco, Splunk
 type: Anomaly
 datamodel: []
@@ -25,14 +25,14 @@ description: 'The following analytic identifies a source user failing to authent
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source account, attempted user accounts and the endpoint were
   the behavior was identified.'
-search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account
-  = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1)
-  | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$"
-  | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as
-  tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts)
-  as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3)
+search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$
+  | bucket span=5m _time 
+  | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as  tried_account by _time, Computer, Caller_User_Name
+  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Computer
+  | eval upperBound=(comp_avg+comp_std*3)
   | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
-  | search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` '
+  | search isOutlier=1 
+  | `windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials_filter` '
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Event Logs from domain controllers as well as member servers and workstations.
   The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
@@ -56,19 +56,19 @@ tags:
   - Stage:Initial Access
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Potential password spraying attack from $ComputerName$
+  message: Potential password spraying attack from $Computer$
   mitre_attack_id:
   - T1110.003
   - T1110
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
-    - Victim
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -76,9 +76,9 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Security_ID
-  - Account_Name
-  - ComputerName
+  - Target_User_Name
+  - Caller_User_Name
+  - Computer
   risk_score: 49
   security_domain: endpoint
   asset_type: Endpoint

detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml

@@ -1,7 +1,7 @@
-name: Multiple Users Failing To Authenticate From Host Using Kerberos
-id: 3a91a212-98a9-11eb-b86a-acde48001122
+name: Windows Unusual Count Of Users Failed To Auth Using Kerberos
+id: bc9cb715-08ba-40c3-9758-6e2b26e455cb
 version: 1
-date: '2021-04-08'
+date: '2022-09-22'
 author: Mauricio Velazco, Splunk
 type: Anomaly
 datamodel: []
@@ -24,12 +24,14 @@ description: 'The following analytic identifies one source endpoint failing to a
 
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source ip and attempted user accounts.'
-search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$"
-  | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
-  as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
-  comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
+search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18
+  | bucket span=5m _time 
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
+  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress 
+  | eval upperBound=(comp_avg+comp_std*3)
   | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
-  | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`'
+  | search isOutlier=1 
+  | `windows_unusual_count_of_users_failed_to_auth_using_kerberos_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting
   `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
@@ -52,19 +54,19 @@ tags:
   - Stage:Initial Access
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Potential Kerberos based password spraying attack from $Client_Address$
+  message: Potential Kerberos based password spraying attack from $IpAddress$
   mitre_attack_id:
   - T1110.003
   - T1110
   observable:
-  - name: Client_Address
+  - name: IpAddress
     type: Endpoint
     role:
-    - Victim
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -72,9 +74,9 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Result_Code
-  - Account_Name
-  - Client_Address
+  - Status
+  - TargetUserName
+  - IpAddress
   risk_score: 49
   security_domain: endpoint
   asset_type: Endpoint

detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml

@@ -1,7 +1,7 @@
-name: Multiple Users Failing To Authenticate From Process
-id: 9015385a-9c84-11eb-bef2-acde48001122
+name: Windows Unusual Count Of Users Failed To Authenticate From Process
+id: 25bdb6cb-2e49-4d34-a93c-d6c567c122fe
 version: 1
-date: '2021-04-13'
+date: '2022-09-22'
 author: Mauricio Velazco, Splunk
 type: Anomaly
 datamodel: []
@@ -25,14 +25,14 @@ description: 'The following analytic identifies a source process name failing to
 
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source process name, source account and attempted user accounts.'
-search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-"
-  | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account
-  = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name)
-  as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName |
-  eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std
-  by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3)
+search: ' `wineventlog_security`  EventCode=4625 Logon_Type=2 ProcessName!="-"
+  | bucket span=2m _time
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer
+  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ProcessName, SubjectUserName, Computer
+  | eval upperBound=(comp_avg+comp_std*3)
   | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
-  | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` '
+  | search isOutlier=1 
+  | `windows_unusual_count_of_users_failed_to_authenticate_from_process_filter` '
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Event Logs from domain controllers aas well as member servers and workstations.
   The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
@@ -55,19 +55,19 @@ tags:
   - Stage:Initial Access
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Potential password spraying attack from $ComputerName$
+  message: Potential password spraying attack from $Computer$
   mitre_attack_id:
   - T1110.003
   - T1110
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
-    - Victim
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -76,10 +76,10 @@ tags:
   - _time
   - EventCode
   - Logon_Type
-  - Caller_Process_Name
-  - Security_ID
-  - Account_Name
-  - ComputerName
+  - ProcessName
+  - SubjectUserName
+  - TargetUserName
+  - Computer
   risk_score: 49
   security_domain: endpoint
   asset_type: Endpoint

detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml

@@ -1,7 +1,7 @@
-name: Multiple Users Failing To Authenticate From Host Using NTLM
-id: 7ed272a4-9c77-11eb-af22-acde48001122
+name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM
+id: 6f6c8fd7-6a6b-4af9-a0e9-57cfc47a58b4
 version: 1
-date: '2021-04-13'
+date: '2022-09-22'
 author: Mauricio Velazco, Splunk
 type: Anomaly
 datamodel: []
@@ -25,12 +25,14 @@ description: 'The following analytic identifies one source endpoint failing to a
 
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source workstation name and attempted user accounts.'
-search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure
-  | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account)
-  as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts)
-  as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3)
+search: ' `wineventlog_security`  EventCode=4776 TargetUserName!=*$ Status=0xC000006A
+  | bucket span=2m _time 
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
+  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation 
+  | eval upperBound=(comp_avg+comp_std*3)
   | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
-  | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`'
+  | search isOutlier=1
+  | `windows_unusual_count_of_users_failed_to_authenticate_using_ntlm_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
   Validation` within `Account Logon` needs to be enabled.
@@ -52,19 +54,19 @@ tags:
   - Stage:Initial Access
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Potential NTLM based password spraying attack from $Source_Workstation$
+  message: Potential NTLM based password spraying attack from $Workstation$
   mitre_attack_id:
   - T1110.003
   - T1110
   observable:
-  - name: Source_Workstation
+  - name: Workstation
     type: Endpoint
     role:
-    - Victim
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -72,9 +74,9 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - action
-  - Logon_Account
-  - Source_Workstation
+  - Status
+  - TargetUserName
+  - Workstation
   risk_score: 49
   security_domain: endpoint
   asset_type: Endpoint

detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml

@@ -1,7 +1,7 @@
-name: Multiple Users Remotely Failing To Authenticate From Host
-id: 80f9d53e-9ca1-11eb-b0d6-acde48001122
+name: Windows Unusual Count Of Users Remotely Failed To Auth From Host
+id: cf06a0ee-ffa9-4ed3-be77-0670ed9bab52
 version: 1
-date: '2021-04-13'
+date: '2022-09-22'
 author: Mauricio Velazco, Splunk
 type: Anomaly
 datamodel: []
@@ -24,13 +24,14 @@ description: 'The following analytic identifies a source host failing to authent
 
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source process name, source account and attempted user accounts.'
-search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-"
-  | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats
-  dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts
-  by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts)
-  as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName
-  | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10
-  and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` '
+search: ' `wineventlog_security`  EventCode=4625 Logon_Type=3 IpAddress!="-"
+  | bucket span=2m _time 
+  | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer
+  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress, Computer
+  | eval upperBound=(comp_avg+comp_std*3)
+  | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) 
+  | search isOutlier=1 
+  | `windows_unusual_count_of_users_remotely_failed_to_auth_from_host_filter` '
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Event Logs from domain controllers as as well as member servers and workstations.
   The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
@@ -53,19 +54,19 @@ tags:
   - Stage:Initial Access
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Potential password spraying attack on $ComputerName$
+  message: Potential password spraying attack on $Computer$
   mitre_attack_id:
   - T1110.003
   - T1110
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
-    - Victim
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -74,10 +75,9 @@ tags:
   - _time
   - EventCode
   - Logon_Type
-  - Security_ID
-  - Account_Name
-  - ComputerName
-  - Source_Network_Address
+  - TargetUserName
+  - Computer
+  - IpAddress
   risk_score: 49
   security_domain: endpoint
   asset_type: Endpoint

macros/wineventlog_security.yml

@@ -1,4 +1,4 @@
-definition: eventtype=wineventlog_security
+definition: eventtype=wineventlog_security OR source="XmlWinEventLog:Security"
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
 name: wineventlog_security

requirements.txt

@@ -1,12 +1,12 @@
 attackcti==0.3.8
 docker==6.0.0
-GitPython==3.1.30
+GitPython==3.1.31
 Jinja2==3.1.2
 jsonschema==4.17.3
 mock==4.0.3
 psutil==5.9.4
 pycvesearch==1.2
-pydantic==1.10.4
+pydantic==1.10.5
 pytest==7.2.1
 PyYAML==5.4.1
 questionary==1.10.0

stories/active_directory_password_spraying.yml

@@ -1,6 +1,6 @@
 name: Active Directory Password Spraying
 id: 3de109da-97d2-11eb-8b6a-acde48001122
-version: 1
+version: 2
 date: '2021-04-07'
 author: Mauricio Velazco, Splunk
 description: Monitor for activities and techniques associated with Password Spraying
@@ -23,9 +23,9 @@ narrative: 'In a password spraying attack, adversaries leverage one or a small l
   Specifically, this Analytic Story is focused on detecting possible Password Spraying
   attacks against Active Directory environments leveraging Windows Event Logs in the
   `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents
-  9 detection analytics which can aid defenders in identifying instances where one
+  16 detection analytics which can aid defenders in identifying instances where one
   source user, source host or source process attempts to authenticate against a target
-  or targets using a high, unsual, number of unique users. A user, host or process
+  or targets using a high or statiscally unsual, number of unique users. A user, host or process
   attempting to authenticate with multiple users is not common behavior for legitimate
   systems and should be monitored by security teams. Possible false positive scenarios
   include but are not limited to vulnerability scanners, remote administration tools,

tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml

@@ -1,12 +0,0 @@
-name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM Unit Test
-tests:
-- name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM
-  file: endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -24h
-  latest_time: now
-  attack_data:
-  - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog

tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml

@@ -1,12 +0,0 @@
-name: Multiple Users Failing To Authenticate From Host Using Kerberos Unit Test
-tests:
-- name: Multiple Users Failing To Authenticate From Host Using Kerberos
-  file: endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -24h
-  latest_time: now
-  attack_data:
-  - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog

tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml

@@ -1,12 +0,0 @@
-name: Multiple Users Failing To Authenticate From Host Using NTLM Unit Test
-tests:
-- name: Multiple Users Failing To Authenticate From Host Using NTLM
-  file: endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -24h
-  latest_time: now
-  attack_data:
-  - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog

tests/endpoint/multiple_users_failing_to_authenticate_from_process.test.yml

@@ -1,12 +0,0 @@
-name: Multiple Users Failing To Authenticate From Process Unit Test
-tests:
-- name: Multiple Users Failing To Authenticate From Process
-  file: endpoint/multiple_users_failing_to_authenticate_from_process.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -24h
-  latest_time: now
-  attack_data:
-  - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog

tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.test.yml

@@ -1,12 +0,0 @@
-name: Multiple Users Remotely Failing To Authenticate From Host Unit Test
-tests:
-- name: Multiple Users Remotely Failing To Authenticate From Host
-  file: endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -24h
-  latest_time: now
-  attack_data:
-  - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog

tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml

@@ -1,12 +0,0 @@
-name: Windows Disabled Users Failing To Authenticate Kerberos Unit Test
-tests:
-- name: Windows Disabled Users Failing To Authenticate Kerberos
-  file: endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -24h
-  latest_time: now
-  attack_data:
-  - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog

tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml

@@ -1,12 +0,0 @@
-name: Windows Invalid Users Failed Authentication via Kerberos Unit Test
-tests:
-- name: Windows Invalid Users Failed Authentication via Kerberos
-  file: endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -24h
-  latest_time: now
-  attack_data:
-  - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog

tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml

@@ -0,0 +1,12 @@
+name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos Unit Test
+tests:
+- name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos
+  file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.test.yml

@@ -0,0 +1,12 @@
+name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos Unit Test
+tests:
+- name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
+  file: endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.test.yml

@@ -0,0 +1,12 @@
+name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM Unit Test
+tests:
+- name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM
+  file: endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.test.yml

@@ -0,0 +1,12 @@
+name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials Unit Test
+tests:
+- name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials
+  file: endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.test.yml

@@ -0,0 +1,12 @@
+name: Windows Multiple Users Failed To Authenticate From Host Using NTLM Unit Test
+tests:
+- name: Windows Multiple Users Failed To Authenticate From Host Using NTLM
+  file: endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_multiple_users_failed_to_authenticate_from_process.test.yml

@@ -0,0 +1,12 @@
+name: Windows Multiple Users Failed To Authenticate From Process Unit Test
+tests:
+- name: Windows Multiple Users Failed To Authenticate From Process
+  file: endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.test.yml

@@ -0,0 +1,12 @@
+name: Windows Multiple Users Failed To Authenticate Using Kerberos Unit Test
+tests:
+- name: Windows Multiple Users Failed To Authenticate Using Kerberos
+  file: endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.test.yml

@@ -0,0 +1,12 @@
+name: Windows Multiple Users Remotely Failed To Authenticate From Host Unit Test
+tests:
+- name: Windows Multiple Users Remotely Failed To Authenticate From Host
+  file: endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.test.yml

@@ -0,0 +1,12 @@
+name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos Unit Test
+tests:
+- name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos
+  file: endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.test.yml

@@ -0,0 +1,12 @@
+name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos Unit Test
+tests:
+- name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos
+  file: endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.test.yml

@@ -0,0 +1,12 @@
+name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM Unit Test
+tests:
+- name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM
+  file: endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.test.yml

@@ -0,0 +1,12 @@
+name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials Unit Test
+tests:
+- name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials
+  file: endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.test.yml

@@ -0,0 +1,12 @@
+name: Windows Unusual Count Of Users Failed To Auth Using Kerberos Unit Test
+tests:
+- name: Windows Unusual Count Of Users Failed To Auth Using Kerberos
+  file: endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.test.yml

@@ -0,0 +1,12 @@
+name: Windows Unusual Count Of Users Failed To Authenticate From Process Unit Test
+tests:
+- name: Windows Unusual Count Of Users Failed To Authenticate From Process
+  file: endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.test.yml

@@ -0,0 +1,12 @@
+name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM Unit Test
+tests:
+- name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM
+  file: endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.test.yml

@@ -0,0 +1,12 @@
+name: Windows Unusual Count Of Users Remotely Failed To Auth From Host Unit Test
+tests:
+- name: Windows Unusual Count Of Users Remotely Failed To Auth From Host
+  file: endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml

@@ -1,12 +0,0 @@
-name: Windows Users Authenticate Using Explicit Credentials Unit Test
-tests:
-- name: Windows Users Authenticate Using Explicit Credentials
-  file: endpoint/windows_users_authenticate_using_explicit_credentials.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -24h
-  latest_time: now
-  attack_data:
-  - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog