Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2022-11-02 11:11:06 -07:00
parent c58aa41519 db270f4119
commit c8ee013dbf
27 changed files with 2024 additions and 205 deletions
@@ -5,7 +5,7 @@
    "id": {
      "group": null, 
      "name": "DA-ESS-ContentUpdate", 
-      "version": "3.51.0"
+      "version": "3.52.0"
    }, 
    "author": [
      {
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -67,6 +67,16 @@ annotations = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky.
 providing_technologies = null

+[savedsearch://ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This hunting search allows operator to discover attempts to exfiltrate data by executing a prepositioned malicious search ID in Analytic Workspace in Splunk Enterprise versions 8.2.9,8.1.12,9.0.2. The attack is browser-based. It requires the attacker to compel a victim to initiate a request within their browser (phishing). The attacker cannot exploit the vulnerability at will.
+how_to_implement = The vulnerability affects only instances with Splunk Web Enabled.  After running this search, please run "Splunk Command and Scripting Interpreter Risky SPL MLTK" to gain more insight into potentially risky commands which could lead to data exfiltration.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1567"], "nist": ["DE.CM"]}
+known_false_positives = This search may produce false positives.  This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. Special attention must be paid to "/en-US/app/search/analytics_workspace?sid=[sid]" which is where the malicious code will be inserted to trigger attack at victim.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk Digital Certificates Infrastructure Version - Rule]
 type = detection
 asset_type = Endpoint
@@ -147,6 +157,36 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
 providing_technologies = null

+[savedsearch://ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This hunting search provides information on possible exploitation attempts against Splunk Secure Gateway App Mobile Alerts feature in Splunk versions 9.0, 8.2.x, 8.1.x. An authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.
+how_to_implement = This search only applies if Splunk Mobile Gateway is deployed in the vulnerable Splunk versions.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.CM"]}
+known_false_positives = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. Focus of this search is "uri_path=/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" which is the injection point.
+providing_technologies = null
+
+[savedsearch://ESCU - Splunk Reflected XSS in the templates lists radio - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = Splunk versions below 8.1.12,8.2.9 and 9.0.2 are vulnerable to reflected cross site scripting (XSS). A View allows for a Reflected Cross Site scripting via JavaScript Object Notation (JSON) in a query parameter when ouput_mode=radio.
+how_to_implement = This vulnerability only affects instances with Splunk Web enabled. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+known_false_positives = This search may produce false positives as it is difficult to pinpoint all possible XSS injection characters in a single search string. Special attention is required to "en-US/list/entities/x/ui/views" which is the vulnerable injection point.
+providing_technologies = null
+
+[savedsearch://ESCU - Splunk Stored XSS via Data Model objectName field - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = Splunk Enterprise versions 8.1.12, 8.2.9, 9.0.2 are vulnerable to persistent cross site scripting via Data Model object name. An authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name Data Model.
+how_to_implement = This vulnerability only affects Splunk Web enabled instances. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+known_false_positives = This search may produce false positives and does not cover exploitation attempts via code obfuscation, focus of search is suspicious requests against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the injection point.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk User Enumeration Attempt - Rule]
 type = detection
 asset_type = endpoint
@@ -167,6 +207,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = Use of the monitoring console where the less-than sign (<) is the first character in the description field.
 providing_technologies = null

+[savedsearch://ESCU - Splunk XSS in Save table dialog header in search page - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This is a hunting search to find persistent cross-site scripting XSS code that was included while inputing data in 'Save Table' dialog in Splunk Enterprise (8.1.12,8.2.9,9.0.2). A remote user with "power" Splunk role can store this code that can lead to persistent cross site scripting.
+how_to_implement = Watch for POST requests combined with XSS script strings or obfuscation against the injection point /en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+known_false_positives = If host is vulnerable and XSS script strings are inputted they will show up in search. Not all Post requests are malicious as they will show when users create and save dashboards. This search may produce several results with non malicious POST requests. Only affects Splunk Web enabled instances.
+providing_technologies = null
+
 [savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
 type = detection
 asset_type = AWS Instance
@@ -724,7 +774,7 @@ asset_type = Azure Active Directory
 confidence = medium
 explanation = The following analytic identifies a successful authentication event against Azure Active Directory for an account without Multi-Factor Authentication enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated
 how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
-annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]}
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM"]}
 known_false_positives = Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
 providing_technologies = null

@@ -1014,6 +1064,66 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Exploitation"], "nist
 known_false_positives = None
 providing_technologies = null

+[savedsearch://ESCU - GCP Authentication Failed During MFA Challenge - Rule]
+type = detection
+asset_type = Google Cloud Platform tenant
+confidence = medium
+explanation = The following analytic identifies an authentication attempt event against a Google Cloud Platform tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. 
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the User log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004", "T1621"], "nist": ["DE.CM"]}
+known_false_positives = Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
+providing_technologies = null
+
+[savedsearch://ESCU - GCP Multi-Factor Authentication Disabled - Rule]
+type = detection
+asset_type = GCP
+confidence = medium
+explanation = The following analytic identifies an attempt to disable multi-factor authentication for a GCP user. An adversary who has obtained access to an GCP tenant may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account. This way the attackers can keep persistance in the environment without adding new users.
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the Admin log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1556"], "nist": ["DE.CM"]}
+known_false_positives = Legitimate use case may require for users to disable MFA. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - GCP Multiple Failed MFA Requests For User - Rule]
+type = detection
+asset_type = Google Cloud Platform tenant
+confidence = medium
+explanation = The following analytic identifies multiple failed multi-factor authentication requests for a single user within a Google Cloud Platform tenant. Specifically, the analytic triggers when 10 or more MFA user prompts fail within 5 minutes. Google CLoud tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `mfa_prompts` threshold values according to your environment. Specifically, this analytic leverages the User log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621", "T1078", "T1078.004"], "nist": ["DE.CM"]}
+known_false_positives = Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - GCP Multiple Users Failing To Authenticate From Ip - Rule]
+type = detection
+asset_type = Google Cloud Platform tenant
+confidence = medium
+explanation = The following analytic identifies one source Ip failing to authenticate into the Google Workspace user accounts with more than 20 unique valid users within 5 minutes. These user accounts may have other privileges with respect to access to other sensitive resources in the Google Cloud Platform. This behavior could represent an adversary performing a Password Spraying attack against an Google Workspace environment to obtain initial access or elevate privileges.
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. Specifically, this analytic leverages the User log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "nist": ["DE.CM"]}
+known_false_positives = No known false postives for this detection. Please review this alert.
+providing_technologies = null
+
+[savedsearch://ESCU - GCP Successful Single-Factor Authentication - Rule]
+type = detection
+asset_type = Google Cloud Platform tenant
+confidence = medium
+explanation = The following analytic identifies a successful authentication event against Google Cloud Platform for an account without Multi-Factor Authentication enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the User log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM"]}
+known_false_positives = Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
+providing_technologies = null
+
+[savedsearch://ESCU - GCP Unusual Number of Failed Authentications From Ip - Rule]
+type = detection
+asset_type = Google Cloud Platform tenant
+confidence = medium
+explanation = The following analytic identifies one source IP failing to authenticate into the Google Workspace with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against a Google Workspace enviroment to obtain initial access or elevate privileges. The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises.  While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `GCP Multiple Users Failing To Authenticate From Ip`
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. Specifically, this analytic leverages the User log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "nist": ["DE.CM"]}
+known_false_positives = No known false positives for this detection. Please review this alert
+providing_technologies = null
+
 [savedsearch://ESCU - GitHub Actions Disable Security Workflow - Rule]
 type = detection
 asset_type = GitHub
@@ -7903,6 +8013,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre
 known_false_positives = administrators rarely use adfind, usually not used for legitimate reasons
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Windows App Layer Protocol Wermgr Connect To NamedPipe - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a suspicious wermgr.exe process creating or connecting to a named pipe. Wermgr.exe is part of Windows OS Problem reporting application responsible for reporting problems, fault or error happen on the Windows OS. This file is being abused by several Threat actors and malware such as Trickbot and Qakbot to execute their malicious code. This anomaly detection can be a good pivot on possible wermgr.exe processes having injected malicious code that might be related to qakbot infection that communicates via named pipe.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, pipename, processguid and named pipe event type from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1071"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Application Layer Protocol RMS Radmin Tool Namedpipe - Rule]
 type = detection
 asset_type = Endpoint
@@ -7973,6 +8093,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = unknown
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Windows Command Shell Fetch Env Variables - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a suspicious process command line fetching the environment variables with a non-shell parent process. This technique was seen in qakbot malware where it fetches the environment variable in the target or compromised host. This TTP detection is a good pivot of possible malicious behavior since the command line is executed by a common non-shell process like cmd.exe , powershell.exe and many more. This can also be a good sign that the parent process has a malicious code injected to it to execute this command.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]}
+known_false_positives = shell process that are not included in this search may cause False positive. Filter is needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Computer Account Created by Computer Account - Rule]
 type = detection
 asset_type = Endpoint
@@ -8222,6 +8352,26 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = False positives may be present, filtering may be required. Remove the Windows Shells macro to determine if other utilities are using iscsicpl.exe.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Windows DLL Side-Loading In Calc - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies suspicious DLL modules loaded by calc.exe that are not in windows %systemroot%\system32 or %systemroot%\sysWoW64 folder. This technique is well used by Qakbot malware to execute its malicious DLL file via dll side loading technique in calc process execution. This TTP detection is a good indicator that a suspicious dll was loaded in a public or non-common installation folder of Windows Operating System that needs further investigation.
+how_to_implement = To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows DLL Side-Loading Process Child Of Calc - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the suspicious child process of calc.exe due to dll side loading technique to execute another executable. This technique was seen in qakbot malware that uses dll side loading technique to calc applications to load its malicious dll code. The malicious dll that abuses dll side loading technique will load the actual qakbot loader dll using regsvr32.exe application. This TTP is a good indicator of qakbot since the calc.exe will not load other child processes aside from win32calc.exe.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows DotNet Binary in Non Standard Path - Rule]
 type = detection
 asset_type = Endpoint
@@ -8652,6 +8802,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Com
 known_false_positives = third party application may use this network protocol as part of its feature. Filter is needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Windows Masquerading Explorer As Child Process - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a suspicious parent process of explorer.exe. Explorer is usually executed by userinit.exe that will exit after execution that causes the main explorer.exe no parent process. Some malware like qakbot spawn another explorer.exe to inject its code. This TTP detection is a good indicator that a process spawning explorer.exe might inject code or masquerading its parent child process to evade detections.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Modify Registry Disable Toast Notifications - Rule]
 type = detection
 asset_type = Endpoint
@@ -8702,6 +8862,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Windows Modify Registry Qakbot Binary Data Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a suspicious registry entry created by Qakbot malware as part of its malicious execution. This "Binary Data" Registry  was created by newly spawn explorer.exe where its malicious code is injected to it. The registry consist of 8 random registry value name with encrypted binary data on its registry value data. This anomaly detections can be a good pivot for possible Qakbot malware infection or other malware that uses registry to save or store there config or malicious code on the registry data stream.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Modify Registry Regedit Silent Reg Import - Rule]
 type = detection
 asset_type = Endpoint
@@ -8956,6 +9126,36 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Rec
 known_false_positives = Administrators or power users may leverage PowerView for system management or troubleshooting.
 providing_technologies = ["Microsoft Windows"]

+[savedsearch://ESCU - Windows Process Injection Of Wermgr to Known Browser - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic identifies the suspicious Remote Thread execution of wermgr.exe process to "firefox.exe", "chrome.exe" and other known browsers. This technique was seen in Qakbot malware that executes its malicious code by injecting its code in legitimate Windows Operating System processes such as wermgr.exe to steal information in the compromised host. This TTP detection can be a good pivot to detect wermgr.exe process injected with qakbot code that tries to remote thread code execution in known browsers like firefox and edge which is not a common behavior of this wermgr.exe application.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055.001", "T1055"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Process Injection Remote Thread - Rule]
+type = detection
+asset_type = 80
+confidence = medium
+explanation = The following analytic identifies a suspicious remote thread execution in some process being abused by threat actor and malware like qakbot. Qakbot is one of the malware using this technique to load its malicious dll module or malicious code in the targeted host. This TTP can be a good pivot to verify what is the behavior of the targeted Image process after this detection trigger. look for network connection, child process execution, file access and many more that helps to verify the indication of malware infection.
+how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts like remote thread EventCode=8 of sysmon. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1055.002"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Process Injection Wermgr Child Process - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a suspicious wermgr.exe parent process having a child process not related to error, fault or windows werfault event. This technique was seen in Qakbot malware where it inject its malicious code in wermgr to evade detections and hide from the analyst to execute its recon and its malicious behavior. This Anomaly detection can be a good pivot to start investigating a possible qakbot infection in the network. The Wermgr.exe process is not known to have other child processes aside from itself or werfault.exe
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Process Injection With Public Source Path - Rule]
 type = detection
 asset_type = 80
@@ -9066,6 +9266,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.00
 known_false_positives = updated windows application needed in safe boot may used this registry
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Windows Regsvr32 Renamed Binary - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following hunting analytic identifies renamed instances of regsv32.exe executing. regsv32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate if it is the legitimate regsv32.exe executing and what dll module content it is loading. This query relies on the original filename or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.010", "T1218"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Remote Access Software BRC4 Loaded Dll - Rule]
 type = detection
 asset_type = Endpoint
@@ -9266,6 +9476,26 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Del
 known_false_positives = False positives should be limited, filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Windows System Discovery Using ldap Nslookup - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the execution of nslookup.exe tool to get domain information. Nslookup.exe is a command-line tool that can display information to diagnose domain name systems. This Nslookup feature is being abused by Qakbot malware to gather domain information such as SRV service location records, server name and many more.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "nist": ["DE.CM"]}
+known_false_positives = dministrator may execute this commandline tool for auditing purposes. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows System Discovery Using Qwinsta - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the execution of qwinsta.exe executable in Windows Operating System. This Windows executable file can display information about sessions on a remote desktop session host server. The information includes servername, sessionname, username and many more. This tool is being abused of Qakbot malware to gather information to the targeted or compromised host that will be send back to its Command and control server.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "nist": ["DE.CM"]}
+known_false_positives = Administrator may execute this commandline tool for auditing purposes. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows System File on Disk - Rule]
 type = detection
 asset_type = Endpoint
@@ -9359,6 +9589,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = This behavior is not commonly seen in production environment and not advisable, filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Windows WMI Impersonate Token - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a possible wmi token impersonation activities in a process or command. This technique was seen in Qakbot malware where it will execute a vbscript code contains wmi impersonation object to gain privilege escalation or as defense evasion. This Anomaly detection looks for wmiprvse.exe SourceImage having a duplicate handle or full granted access in a target process.
+how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1047"], "nist": ["DE.CM"]}
+known_false_positives = administrator may execute impersonate wmi object script for auditing. Filter is needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows WMI Process Call Create - Rule]
 type = detection
 asset_type = Endpoint
@@ -9469,7 +9709,7 @@ confidence = medium
 explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
-known_false_positives = network administrator may used this command for checking purposes
+known_false_positives = Network administrator may used this command for checking purposes
 providing_technologies = ["Microsoft Windows"]

 [savedsearch://ESCU - Wmic Group Discovery - Rule]
@@ -9746,6 +9986,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = This search may reveal non malicious URLs with environment variables used in organizations.
 providing_technologies = null

+[savedsearch://ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This hunting search provides information about a vulnerability in Splunk Enterprise versions below 8.2.9, 8.1.12, 9.0.2, where an authenticated user can execute arbitrary code via the dashboard pdf generation component. Please review events with file=export in the _internal index for the potential targets of exploitation.
+how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.CM"]}
+known_false_positives = Not all exports and downloads are malicious, special attention must be put as well on /en-US/splunkd/__raw/services/pdfgen/render in the context of this search.
+providing_technologies = null
+
 [savedsearch://ESCU - Suspicious Email Attachment Extensions - Rule]
 type = detection
 asset_type = Endpoint
@@ -10763,6 +11013,30 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Exploit Public Facing Application via Apache Commons Text - Rule]
+type = detection
+asset_type = Web Server
+confidence = medium
+explanation = The following analytic identifies activity related to Text4Shell, or the critical vulnerability CVE-2022-42889 in Apache Commons Text Library. Apache Commons Text versions 1.5 through 1.9 are affected, but it has been patched in version 1.10. The analytic may need to be tuned for your environment before enabling as a TTP, or direct Notable. Apache Commons Text is a Java library described as a library focused on algorithms working on strings. We can see it as a general-purpose text manipulation toolkit. This vulnerability affects the StringSubstitutor interpolator class, which is included in the Commons Text library. A default interpolator allows for string lookups that can lead to Remote Code Execution. This is due to a logic flaw that makes the script, dns, and url lookup keys interpolated by default, as opposed to what it should be, according to the documentation of the StringLookupFactory class. Those keys allow an attacker to execute arbitrary code via lookups.
+how_to_implement = To implement, one must be collecting network traffic that is normalized in CIM and able to be queried via the Web datamodel. Or, take the chunks out needed and tie to a specific network source type to hunt in. Tune as needed, or remove the other_lookups statement.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.CM"]}
+known_false_positives = False positives are present when the values are set to 1 for utf and lookup. It's possible to raise this to TTP (direct notable) if removal of other_lookups occur and Score is raised to 2 (down from 4).
+providing_technologies = null
+
+[savedsearch://ESCU - Fortinet Appliance Auth bypass - Rule]
+type = detection
+asset_type = Network
+confidence = medium
+explanation = CVE-2022-40684 is a Fortinet appliance auth bypass that is actively being exploited and a POC is released publicy. The POC adds a SSH key to the appliance. Note that the exploit can be used with any HTTP method (GET, POST, PUT, DELETE, etc). The REST API request failing is not an indication that an attacker was unsuccessful. Horizon3 was able to modify the admin SSH keys though a REST API request that reportedly failed. The collection /api/v2/ endpoints can be used to configure the system and modify the administrator user. Any logs found that meet the above conditions and also have a URL containing /api/v2/ should be cause for concern. Further investigation of any matching log entries can reveal any damage an attack has done. Additionally, an attacker may perform the following actions to further compromise a system Modify the admin SSH key to enable the attacker to login to the compromised system. \
+Add new local users. \
+Update networking configurations to reroute traffic. \
+Download the system configuration. \
+Initiate packet captures to capture other sensitive system information. Reference Horizon3.ai
+how_to_implement = This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache. Splunk for Nginx, or Splunk for Palo Alto.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+known_false_positives = GET requests will be noisy and need to be filtered out or removed from the query based on volume. Restrict analytic to known publically facing Fortigates, or run analytic as a Hunt until properly tuned. It is also possible the user agent may be filtered on Report Runner or Node.js only for the exploit, however, it is unknown at this if other user agents may be used.
+providing_technologies = null
+
 [savedsearch://ESCU - Log4Shell JNDI Payload Injection Attempt - Rule]
 type = detection
 asset_type = Endpoint
@@ -11100,7 +11374,7 @@ maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
 spec_version = 3
 searches = ["ESCU - Azure Active Directory High Risk Sign-in - Rule", "ESCU - Azure AD Authentication Failed During MFA Challenge - Rule", "ESCU - Azure AD Multi-Factor Authentication Disabled - Rule", "ESCU - Azure AD Multiple Failed MFA Requests For User - Rule", "ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - Azure AD Successful PowerShell Authentication - Rule", "ESCU - Azure AD Successful Single-Factor Authentication - Rule", "ESCU - Azure AD Unusual Number of Failed Authentications From Ip - Rule"]
 description = Monitor for activities and techniques associated with Account Takover attacks against Azure Active Directory tenants.
-narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization.\ This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.
+narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.

 [analytic_story://Azure Active Directory Persistence]
 category = Cloud Security
@@ -11299,6 +11573,17 @@ narrative = Credential dumping&#151;gathering credentials from a target system,
 Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\
 The detection searches in this Analytic Story monitor access to the Local Security Authority Subsystem Service (LSASS) process, the usage of shadowcopies for credential dumping and some other techniques for credential dumping.

+[analytic_story://CVE-2022-40684 Fortinet Appliance Auth bypass]
+category = Adversary Tactics
+last_updated = 2022-10-14
+version = 1
+references = ["https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/", "https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/", "https://github.com/horizon3ai/CVE-2022-40684", "https://attackerkb.com/topics/QWOxGIKkGx/cve-2022-40684/rapid7-analysis", "https://www.greynoise.io/blog/fortios-authentication-bypass"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Fortinet Appliance Auth bypass - Rule"]
+description = Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects CVE-2022-40684.
+narrative = FortiOS exposes a management web portal that allows a user configure the system. Additionally, a user can SSH into the system which exposes a locked down CLI interface. Any HTTP requests to the management interface of the system that match the conditions above should be cause for concern. An attacker can use this vulnerability to do just about anything they want to the vulnerable system. This includes changing network configurations, adding new users, and initiating packet captures. Note that this is not the only way to exploit this vulnerability and there may be other sets of conditions that work. For instance, a modified version of this exploit uses the User-Agent Node.js. This exploit seems to follow a trend among recently discovered enterprise software vulnerabilities where HTTP headers are improperly validated or overly trusted. (ref Horizon3.ai)
+
 [analytic_story://CyclopsBLink]
 category = Malware
 last_updated = 2022-04-07
@@ -11677,6 +11962,17 @@ searches = ["ESCU - Check Elevated CMD using whoami - Rule", "ESCU - Cmdline Too
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated with its payload, data collection and script execution.
 narrative = FIN7 is a Russian criminal advanced persistent threat group that has primarily targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. A portion of FIN7 is run out of the front company Combi Security. It has been called one of the most successful criminal hacking groups in the world. this passed few day FIN7 tools and implant are seen in the wild where its code is updated. the FIN& is known to use the spear phishing attack as a entry to targetted network or host that will drop its staging payload like the JS and JSSloader. Now this artifacts and implants seen downloading other malware like cobaltstrike and event ransomware to encrypt host.

+[analytic_story://GCP Account Takeover]
+category = Account Compromise
+last_updated = 2022-10-12
+version = 1
+references = ["https://cloud.google.com/gcp", "https://cloud.google.com/architecture/identity/overview-google-authentication", "https://attack.mitre.org/techniques/T1586/", "https://www.imperva.com/learn/application-security/account-takeover-ato/", "https://www.barracuda.com/glossary/account-takeover"]
+maintainers = [{"company": "Bhavin Patel, Splunk", "email": "-", "name": "Mauricio Velazco"}]
+spec_version = 3
+searches = ["ESCU - GCP Authentication Failed During MFA Challenge - Rule", "ESCU - GCP Multi-Factor Authentication Disabled - Rule", "ESCU - GCP Multiple Failed MFA Requests For User - Rule", "ESCU - GCP Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - GCP Successful Single-Factor Authentication - Rule", "ESCU - GCP Unusual Number of Failed Authentications From Ip - Rule"]
+description = Monitor for activities and techniques associated with Account Takover attacks against Google Cloud Platform tenants.
+narrative = Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.
+
 [analytic_story://GCP Cross Account Activity]
 category = Cloud Security
 last_updated = 2020-09-01
@@ -12159,6 +12455,17 @@ searches = ["ESCU - Detect Exchange Web Shell - Rule", "ESCU - Exchange PowerShe
 description = ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server - CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.
 narrative = During Pwn2Own April 2021, a security researcher demonstrated an attack  chain targeting on-premise Microsoft Exchange Server. August 5th, the same researcher  publicly released further details and demonstrated the attack chain. CVE-2021-34473  Pre-auth path confusion leads to ACL Bypass (Patched in April by KB5001779)  CVE-2021-34523 - Elevation of privilege on Exchange PowerShell backend (Patched in April by KB5001779) . CVE-2021-31207 - Post-auth Arbitrary-File-Write  leads to RCE (Patched in May by KB5003435) Upon successful exploitation,  the remote attacker will have SYSTEM privileges on the Exchange Server. In addition    to remote access/execution, the adversary may be able to run Exchange PowerShell  Cmdlets to perform further actions.

+[analytic_story://Qakbot]
+category = Malware
+last_updated = 2022-10-12
+version = 1
+references = ["https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf", "https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot", "https://securelist.com/qakbot-technical-analysis/103931/", "https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
+spec_version = 3
+searches = ["ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Network Discovery Using Route Windows App - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - System User Discovery With Whoami - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Windows App Layer Protocol Wermgr Connect To NamedPipe - Rule", "ESCU - Windows Command Shell Fetch Env Variables - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DLL Side-Loading In Calc - Rule", "ESCU - Windows DLL Side-Loading Process Child Of Calc - Rule", "ESCU - Windows Masquerading Explorer As Child Process - Rule", "ESCU - Windows Modify Registry Qakbot Binary Data Registry - Rule", "ESCU - Windows Process Injection Of Wermgr to Known Browser - Rule", "ESCU - Windows Process Injection Remote Thread - Rule", "ESCU - Windows Process Injection Wermgr Child Process - Rule", "ESCU - Windows Regsvr32 Renamed Binary - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows System Discovery Using ldap Nslookup - Rule", "ESCU - Windows System Discovery Using Qwinsta - Rule", "ESCU - Windows WMI Impersonate Token - Rule", "ESCU - Windows WMI Process Call Create - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule"]
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Qakbot/QBot malware including parent-child process anomalies, persistence, initial access, recon and many more. Qakbot is a modular information stealer that has been active since 2007. It is also has historical background to be banking Trojan that steals financial data from infected or compromised system.
+narrative = Qakbot is also known to leverage tools like powershell, process injection, and mimikatz for its malicious activities. This malware was on the CISA top malware list for 2021.
+
 [analytic_story://Ransomware]
 category = Malware
 last_updated = 2020-02-04
@@ -12326,7 +12633,7 @@ version = 1
 references = ["https://www.splunk.com/en_us/product-security/announcements.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
 spec_version = 3
-searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
+searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
 description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.
 narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly.

@@ -12611,6 +12918,17 @@ description = Attackers are using Zoom as an vector to increase privileges on a
 narrative = Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\
 Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation.

+[analytic_story://Text4Shell CVE-2022-42889]
+category = Adversary Tactics
+last_updated = 2022-10-26
+version = 1
+references = ["https://sysdig.com/blog/cve-2022-42889-text4shell/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Exploit Public Facing Application via Apache Commons Text - Rule"]
+description = A new critical vulnerability CVE-2022-42889 a.k.a. Text4shell, similar to the old Spring4Shell and Log4Shell, was originally reported by Alvaro Munoz on the very popular Apache Commons Text library.
+narrative = Apache Commons Text is a Java library described as "a library focused on algorithms working on strings." We can see it as a general-purpose text manipulation toolkit. This vulnerability affects the StringSubstitutor interpolator class, which is included in the Commons Text library. A default interpolator allows for string lookups that can lead to Remote Code Execution. This is due to a logic flaw that makes the "script," "dns," and "url" lookup keys interpolated by default, as opposed to what it should be, according to the documentation of the StringLookupFactory class. Those keys allow an attacker to execute arbitrary code via lookups. In order to exploit the vulnerabilities, the following requirements must be met - Run a version of Apache Commons Text from version 1.5 to 1.9 and use the StringSubstitutor interpolator. It is important to specify that the StringSubstitutor interpolator is not as widely used as the string substitution in Log4j, which led to Log4Shell. According to the CVSSv3 system, it scores 9.8 as CRITICAL severity. The severity is Critical due to the easy exploitability and huge potential impact in terms of confidentiality, integrity, and availability. As we showed in the previous section, you can take full control over the vulnerable system with a crafted request. However, it is not likely the vulnerabilities will have the same impacts as the previous Log4Shell and Spring4Shell.
+
 [analytic_story://Trickbot]
 category = Malware
 last_updated = 2021-04-20
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 10578
+build = 10902

 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple

 [launcher]
 author = Splunk
-version = 3.51.0
+version = 3.52.0
 description = Explore the Analytic Stories included with ES Content Updates.

 [ui]
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.51.0
+version = 3.52.0
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -29,6 +29,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_data_exfiltration_from_analytics_workspace_using_sid_query_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_digital_certificates_infrastructure_version_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -61,6 +65,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[splunk_reflected_xss_in_the_templates_lists_radio_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[splunk_stored_xss_via_data_model_objectname_field_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_user_enumeration_attempt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -69,6 +85,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_xss_in_save_table_dialog_header_in_search_page_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -405,6 +425,30 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[gcp_authentication_failed_during_mfa_challenge_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_multi_factor_authentication_disabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_multiple_failed_mfa_requests_for_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_multiple_users_failing_to_authenticate_from_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_successful_single_factor_authentication_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_unusual_number_of_failed_authentications_from_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [github_actions_disable_security_workflow_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3101,6 +3145,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_app_layer_protocol_wermgr_connect_to_namedpipe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3129,6 +3177,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_command_shell_fetch_env_variables_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_computer_account_created_by_computer_account_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3225,6 +3277,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_dll_side_loading_in_calc_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_dll_side_loading_process_child_of_calc_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_dotnet_binary_in_non_standard_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3389,6 +3449,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_masquerading_explorer_as_child_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_modify_registry_disable_toast_notifications_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3409,6 +3473,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_modify_registry_qakbot_binary_data_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_modify_registry_regedit_silent_reg_import_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3509,6 +3577,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_process_injection_of_wermgr_to_known_browser_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_process_injection_remote_thread_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_process_injection_wermgr_child_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_process_injection_with_public_source_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3553,6 +3633,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_regsvr32_renamed_binary_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_remote_access_software_brc4_loaded_dll_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3633,6 +3717,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_system_discovery_using_ldap_nslookup_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_system_discovery_using_qwinsta_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_system_file_on_disk_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3669,6 +3761,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_wmi_impersonate_token_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_wmi_process_call_create_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3817,6 +3913,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_code_injection_via_custom_dashboard_leading_to_rce_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [suspicious_email_attachment_extensions_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4209,6 +4309,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[exploit_public_facing_application_via_apache_commons_text_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[fortinet_appliance_auth_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [log4shell_jndi_payload_injection_attempt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4250,6 +4358,10 @@ definition = search *
 description = Update this macro to limit the output results to filter out false positives.


+[audit_searches]
+definition = index=_audit sourcetype=audittrail action=search
+description = Macro to enable easy searching of audittrail logs for searches
+
 [aws_cloudwatchlogs_eks]
 definition = sourcetype="aws:cloudwatchlogs:eks"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -4406,6 +4518,18 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = sourcetype=gsuite:gmail:bigquery
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

+[gws_login_mfa_methods]
+definition = event.parameters{}.multiValue{} IN ("backup_code", "google_authenticator", "google_prompt", "idv_any_phone", "idv_preregistered_phone", "internal_two_factor", "knowledge_employee_id", "knowledge_preregistered_email", "login_location", "knowledge_preregistered_phone", "offline_otp", "security_key", "security_key_otp")
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[gws_reports_admin]
+definition = sourcetype=gws:reports:admin
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[gws_reports_login]
+definition = sourcetype=gws:reports:login
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [is_net_windows_file]
 definition = lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true
 description = This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11.
@@ -4710,6 +4834,10 @@ description = Matches the process with its original file name, data for this mac
 definition = (Processes.process_name=wbadmin.exe OR Processes.original_file_name=WBADMIN.EXE)
 description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

+[process_wermgr]
+definition = (Processes.process_name=wermgr.exe OR Processes.original_file_name=wermgr.EXE)
+description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+
 [process_wmic]
 definition = (Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)
 description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
@@ -4767,10 +4895,22 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = index=_audit "action=login attempt" "info=failed"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

+[splunkd_ui]
+definition = index=_internal sourcetype=splunkd_ui_access
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [splunkd_web]
 definition = index=_internal sourcetype=splunk_web_access
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

+[splunkd_webx]
+definition = index=_internal sourcetype=access_combined_wcookie
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[splunkda]
+definition = index=_internal sourcetype=splunkd_access
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [stream_dns]
 definition = sourcetype=stream:dns
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -0,0 +1,65 @@
+name: Office Product Spawning Windows Script Host
+id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6
+version: 1
+description: The following analytic will identify a Windows Office Product spawning
+  WScript.exe or CScript.exe. Tuning may be required based on legitimate application
+  usage that may spawn scripts from an Office product.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"),
+  "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name
+  IS NOT NULL | where (like(parent_process_name, "%\\\\winword.exe") OR like(parent_process_name,
+  "%\\\\excel.exe") OR like(parent_process_name, "%\\\\powerpnt.exe") OR like(parent_process_name,
+  "%\\\\mspub.exe") OR like(parent_process_name, "%\\\\visio.exe")) AND (process_name="wscript.exe"
+  OR process_name="cscript.exe") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present based on macro based approved
+  documents in the organization. Filtering may be needed.
+references:
+- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  cis20:
+  - CIS 8
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566
+  - T1566.001
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 63
+  security_domain: endpoint
+  risk_severity: medium
+  research_site_url: https://research.splunk.com/endpoint/3ea3851a-8736-41a0-bc09-7e4485b48fa6/
+  event_schema: cim
+test:
+  name: Office Product Spawning Windows Script Host Unit Test
+  tests:
+  - name: Office Product Spawning Windows Script Host
+    file: endpoint/ssa___office_product_spawning_windows_script_host.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
+      source: XmlWinEventLog
@@ -0,0 +1,70 @@
+name: Windows COM Hijacking InprocServer32 Modification
+id: 0ae05a0f-bc84-456b-822a-a5b9c081c7ca
+version: 1
+description: The following analytic identifies the use of reg.exe performing an add
+  to the InProcServer32, which may be related to COM hijacking. Adversaries can use
+  the COM system to insert malicious code that can be executed in place of legitimate
+  software through hijacking the COM references and relationships as a means for persistence.
+  Hijacking a COM object requires a change in the Registry to replace a reference
+  to a legitimate system component which may cause that component to not work when
+  executed. When that system component is executed through normal system operation
+  the adversary's code will be executed instead.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="reg.exe"
+  AND like (cmd_line, "%inprocserver32%") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
+  "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present and some filtering may be required.
+references:
+- https://attack.mitre.org/techniques/T1546/015/
+- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1546.015
+  - T1546
+  nist:
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 64
+  security_domain: endpoint
+  risk_severity: medium
+  research_site_url: https://research.splunk.com/endpoint/0ae05a0f-bc84-456b-822a-a5b9c081c7ca/
+  event_schema: cim
+test:
+  name: Windows COM Hijacking InprocServer32 Modification Unit Test
+  tests:
+  - name: Windows COM Hijacking InprocServer32 Modification
+    file: endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
+    pass_condition: '| stats count | where count > 0'
+    attack_data:
+    - file_name: windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log
+      source: XmlWinEventLog
@@ -0,0 +1,92 @@
+name: Windows Exchange PowerShell Module Usage
+id: 1118bc65-b0c7-4589-bc2f-ad6802fd0909
+version: 1
+description: 'The following analytic identifies the usage of Exchange PowerShell modules
+  that were recently used for a proof of concept related to ProxyShell. Currently,
+  there is no active data shared or data we could re-produce relate to this part of
+  the ProxyShell chain of exploits.  \
+
+  Inherently, the usage of the modules is not malicious, but reviewing parallel processes,
+  and user, of the session will assist with determining the intent. \
+
+  Module - New-MailboxExportRequest will begin the process of exporting contents of
+  a primary mailbox or archive to a .pst file. \
+
+  Module - New-managementroleassignment can assign a management role to a management
+  role group, management role assignment policy, user, or universal security group
+  (USG). \
+
+  Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate
+  of search results, place search results on In-Place Hold or copy them to a Discovery
+  mailbox. You can also place all contents in a mailbox on hold by not specifying
+  a search query, which accomplishes similar results as Litigation Hold. \ Module
+  - Get-Recipient cmdlet to view existing recipient objects in your organization.
+  This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users,
+  mail contacts, and distribution groups).'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where (like (cmd_line, "%new-mailboxexportrequest%")
+  OR like (cmd_line, "%new-managementroleassignment%") OR like (cmd_line, "%new-mailboxsearch%")
+  OR like (cmd_line,"%get-recipient%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  This will only work with Multiline event logs, not XML.
+known_false_positives: Administrators or power users may use this PowerShell commandlet
+references:
+- https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
+- https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
+- https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
+- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
+- https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
+- https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps
+- https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps
+- https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
+tags:
+  analytic_story:
+  - ProxyShell
+  - CISA AA22-264A
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1059
+  - T1059.001
+  nist:
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 32
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/1118bc65-b0c7-4589-bc2f-ad6802fd0909/
+  event_schema: cim
+test:
+  name: Windows Exchange PowerShell Module Usage Unit Test
+  tests:
+  - name: Windows Exchange PowerShell Module Usage
+    file: endpoint/ssa___windows_exchange_powershell_module_usage.yml
+    pass_condition: '| stats count | where count > 0'
+    attack_data:
+    - file_name: pwsh_multipass.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/pwsh_multipass.log
+      source: WinEventLog
@@ -13,20 +13,19 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
  null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);

-  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe"
-  OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bitsadmin.exe"
-  OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe"
-  OR process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe"
-  OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe"
-  OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe"
-  OR process_name="diantz.exe" OR process_name="diskshadow.exe" OR process_name="dllhost.exe"
-  OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe"
-  OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe"
-  OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe"
-  OR process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe"
-  OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe"
-  OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe"
-  OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe"
+  $cond_1 = | from $ssa_input | where process_name="bitsadmin.exe" OR process_name="certoc.exe"
+  OR process_name="certreq.exe" OR process_name="certutil.exe" OR process_name="cmdkey.exe"
+  OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe"
+  OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe"
+  OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe"
+  OR process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe"
+  OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe"
+  OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe"
+  OR process_name="finger.exe" OR process_name="fltmc.exe" OR process_name="forfiles.exe"
+  OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe"
+  OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe"
+  OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe"
+  OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe"
  OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe"
  OR process_name="mshta.exe" OR process_name="msiexec.exe" OR process_name="netsh.exe"
  OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="pcalua.exe"
@@ -50,6 +50,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/c842931e-661f-42bc-a4df-0460d93cfb69/
+  event_schema: cim
 test:
  name: Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard
    Path Unit Test
@@ -50,6 +50,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/ecaaf956-c516-4980-b08e-8c01c19614ca/
+  event_schema: cim
 test:
  name: Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path Unit
    Test
@@ -49,6 +49,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/3284e4f4-67f7-49b6-ad5e-a8fcead2eef8/
+  event_schema: cim
 test:
  name: Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path Unit
    Test
@@ -49,6 +49,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/e124f71f-11bc-47e4-9931-6046d256005d/
+  event_schema: cim
 test:
  name: Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path
    Unit Test
@@ -50,6 +50,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/057c06c7-ef31-4749-b5c9-199152e53a06/
+  event_schema: cim
 test:
  name: Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path
    Unit Test
@@ -50,6 +50,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/93862a89-abe0-4094-909a-08ec390aa5e3/
+  event_schema: cim
 test:
  name: Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path Unit
    Test
@@ -50,6 +50,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/d75cc561-3828-4d0a-92c4-0eb93bfe0929/
+  event_schema: cim
 test:
  name: Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard
    Path Unit Test
@@ -49,6 +49,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/6401d583-0052-4dc5-a713-68b510826d2b/
+  event_schema: cim
 test:
  name: Windows Rename System Utilities At exe LOLBAS in Non Standard Path Unit Test
  tests:
@@ -49,6 +49,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/b8da7ea5-8c16-4eff-9787-54ec271159e0/
+  event_schema: cim
 test:
  name: Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path Unit
    Test