Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2023-02-21 13:06:15 -08:00
parent e9c29ff2e3 95b05f0138
commit cb20193045
16 changed files with 1904 additions and 1302 deletions
@@ -5,7 +5,7 @@
    "id": {
      "group": null, 
      "name": "DA-ESS-ContentUpdate", 
-      "version": "3.59.0"
+      "version": "3.60.0"
    }, 
    "author": [
      {
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-14T17:42:34 UTC
+# On Date: 2023-02-21T20:55:18 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -4937,6 +4937,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Act
 known_false_positives = Filtering may be required. In addition to AWS credentials, add other important files and monitor. The inverse would be to look for _all_ -F behavior and tune from there.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Linux Data Destruction Command - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a unix shell command that can wipe root folders of a linux host. This commandline is being abused by Awfulshred malware that wipes or corrupts files in a targeted Linux host. The shell command uses the rm command with force recursive deletion even in the root folder. This TTP can be a good indicator that a user or a process wants to wipe roots directory files in Linux host.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Linux DD File Overwrite - Rule]
 type = detection
 asset_type = endpoint
@@ -5137,6 +5147,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = False positives may be present, filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Linux Hardware Addition SwapOff - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic looks for process execution to disable the swapping of paging devices. This technique was seen in Awfulshred malware that disables the swapping of the specified devices and files. This anomaly detection can be a good indicator that a process or a user tries to disable this Linux feature in a targeted host.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1200"], "nist": ["DE.CM"]}
+known_false_positives = administrator may disable swapping of devices in a linux host. Filter is needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Linux High Frequency Of File Deletion In Boot Folder - Rule]
 type = detection
 asset_type = endpoint
@@ -5157,6 +5177,36 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = linux package installer/uninstaller may cause this event. Please update you filter macro to remove false positives.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Linux Impair Defenses Process Kill - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic looks for PKILL process execution for possible termination of process. This technique is being used by several Threat actors, adversaries and red teamers to terminate processes in a targeted linux machine. This Hunting detection can be a good pivot to check a possible defense evasion technique or termination of security application in a linux host or wiper like Awfulshred that corrupt all files.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
+known_false_positives = network admin can terminate a process using this linux command. Filter is needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Linux Indicator Removal Clear Cache - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic looks for processes that clear or free page cache in Linux system host. This technique was seen in Awfulshred malware wiper that tries to clear the cache using kernel system request drop_caches while wiping all files in the targeted host. This TTP detection can be a good indicator of user or process tries to clear page cache to delete tracks or might be a wiper like Awfulshred.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Linux Indicator Removal Service File Deletion - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic looks for suspicious linux processes that delete service unit configuration files. This technique was seen in several malware to delete service configuration files to corrupt a services or security product as part of its defense evasion. This TTP detection can be a good indicator of possible malware try to kill several services or a wiper like AwfulShred shell script that wipes the targeted linux host
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004", "T1070"], "nist": ["DE.CM"]}
+known_false_positives = network admin can delete services unit configuration file as part of normal software installation. Filter is needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Linux Ingress Tool Transfer Hunting - Rule]
 type = detection
 asset_type = Endpoint
@@ -5607,6 +5657,26 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Rec
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Linux System Reboot Via System Request Key - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic is to look for possible execution of SysReq hack to reboot the Linux system host. This technique was seen in Awfulshred malware wiper to reboot the compromised host by using the linux magic sysreq key. This kernel configuration can trigger reboot by piping out 'b' to /proc/sysrq-trigger after enabling all the functions of sysrq. This TTP detection can be a good indicator of possible suspicious processes running on the Linux host since this command is not a common way to reboot a system.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1529"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Linux Unix Shell Enable All SysRq Functions - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic is to look for possible execution of SysReq hack to enable all functions of kernel system requests of the Linux system host. This technique was seen in AwfulShred malware wiper to reboot the compromised host by using the linux magic sysreq key. This kernel configuration can be triggered by piping out bitmask '1' to /proc/sys/kernel/sysrq. This TTP detection can be a good indicator of possible suspicious processes running on the Linux host since this command is not so common shell commandline.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.004", "T1059"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Linux Visudo Utility Execution - Rule]
 type = detection
 asset_type = Endpoint
@@ -8015,7 +8085,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = this search is designed to detect potential malicious process loading COM object to wbemprox.dll,
+explanation = The following analytic identifies a potential suspicious process loading a COM object from wbemprox.dll or faskprox.dll. The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. This feature is being abused by several threat actors, adversaries or even red teamers to gain privilege escalation or even to evade detections. This TTP is a good indicator that a process is loading possible known .dll modules that were known for its COM object.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"]}
 known_false_positives = legitimate process that are not in the exception list may trigger this event.
@@ -9090,6 +9160,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = False positives should be limited as this is directly looking for Mimikatz, the credential dumping utility.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Windows Mimikatz Crypto Export File Extensions - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies hardcoded extensions related to the Crypo module within Mimikatz. Moving certificates or downloading them is not malicious, however with Mimikatz having hardcoded names it helps to identify potential usage of certificates being exported.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1649"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present and may need to be reviewed before this can be turned into a TTP. In addition, remove .pfx (standalone) if it's too much volume.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Modify Registry Default Icon Setting - Rule]
 type = detection
 asset_type = Endpoint
@@ -9938,7 +10018,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = this detection was designed to identifies suspicious office documents that connect to a website aside from Microsoft Office Domain. This technique was seen in several malicious documents that abuses .rels xml properties of MS office to connect or download malicious files. This hunting query can a good pivot or guide to check what URL link it tries to connect, what domain, where the documents came from and how the connection happens.
+explanation = this detection was designed to identifies suspicious office documents that connect to a website aside from Microsoft Office Domain. This technique was seen in several malicious documents that abuses .rels xml properties of MS office to connect or download malicious files. This hunting query can be a good pivot or guide to check what URL link it tries to connect, what domain, where the documents came from and how the connection happens.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"], "nist": ["DE.CM"]}
 known_false_positives = Windows Office document may contain legitimate url link other than MS office Domain. filter is needed
@@ -9984,6 +10064,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Act
 known_false_positives = False positives will be generated based on normal certificate store backups. Leave enabled to generate Risk, as this is meant to be an anomaly analytic. If CS backups are not normal, enable as TTP.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

+[savedsearch://ESCU - Windows Steal Authentication Certificates CryptoAPI - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic utilizes a Windows Event Log - CAPI2 - or CryptoAPI 2, to identify suspicious certificate extraction. Typically, this event log is meant for diagnosing PKI issues, however is a great source to identify certificate exports. Note that this event log is noisy as it captures common PKI requests from many different processes. EventID 70 is generated anytime a certificate is exported. The description for EventID 70 is "Acquire Certificate Private Key". STRT tested this analytic using Mimikatz binary and the implementation of Mimikatz in Cobalt Strike.
+how_to_implement = To implement this analytic, one will need to enable the Microsoft-Windows-CAPI2/Operational log within the Windows Event Log. Note this is a debug log for many purposes, and the analytic only focuses in on EventID 70. Review the following gist for additional enabling information.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1649"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present in some instances of legitimate applications requiring to export certificates. Filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Windows Steal Authentication Certificates CS Backup - Rule]
 type = detection
 asset_type = Endpoint
@@ -11006,7 +11096,7 @@ explanation = This search looks for execution of process `outlook.exe` where the
 how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon.
 annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = It is not uncommon for outlook to write legitimate zip files to the disk.
-providing_technologies = null
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]

 [savedsearch://ESCU - Detect Rare Executables - Rule]
 type = detection
@@ -11839,6 +11929,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = False positives are present when the values are set to 1 for utf and lookup. It's possible to raise this to TTP (direct notable) if removal of other_lookups occur and Score is raised to 2 (down from 4).
 providing_technologies = null

+[savedsearch://ESCU - Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 - Rule]
+type = detection
+asset_type = Network
+confidence = medium
+explanation = The following analytic identifies a recent CVE-2022-39952 released publicly where the URI configWizard/keyUpload.jsp recieves a POST with the payload.zip, from there the POC script will schedule a cron to run the payload and contact the remote C2.
+how_to_implement = This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation", "Installation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present. Modify the query as needed to POST, or add additional filtering (based on log source).
+providing_technologies = null
+
 [savedsearch://ESCU - Fortinet Appliance Auth bypass - Rule]
 type = detection
 asset_type = Network
@@ -12098,6 +12198,17 @@ searches = ["ESCU - Java Writing JSP File - Rule", "ESCU - Confluence Unauthenti
 description = On June 2, security researchers at Volexity published a blog outlining the discovery of an unauthenticated remote code execution zero day vulnerability (CVE-2022-26134) being actively exploited in Atlassian Confluence Server and Data Center instances in the wild. Atlassian released a fix within 24 hours of the blog''s release.
 narrative = Atlassian describes the vulnerability as an Object-Graph Navigation Language (OGNL) injection allowing an unauthenticated user to execute arbitrary code on a Confluence Server or Data Server instance. Volexity did not release proof-of-concept (POC) exploit code, but researchers there have observed coordinated, widespread exploitation. Volexity first discovered the vulnerability over the weekend on two Internet-facing web servers running Confluence Server software. The investigation was due to suspicious activity on the hosts, including JSP webshells that were written to disk.

+[analytic_story://AwfulShred]
+category = Malware
+last_updated = 2023-01-24
+version = 1
+references = ["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/", "https://cert.gov.ua/article/3718487"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
+spec_version = 3
+searches = ["ESCU - Linux Data Destruction Command - Rule", "ESCU - Linux Deleting Critical Directory Using RM Command - Rule", "ESCU - Linux Deletion Of Services - Rule", "ESCU - Linux Disable Services - Rule", "ESCU - Linux Hardware Addition SwapOff - Rule", "ESCU - Linux Impair Defenses Process Kill - Rule", "ESCU - Linux Indicator Removal Clear Cache - Rule", "ESCU - Linux Indicator Removal Service File Deletion - Rule", "ESCU - Linux Service Restarted - Rule", "ESCU - Linux Shred Overwrite Command - Rule", "ESCU - Linux Stop Services - Rule", "ESCU - Linux System Reboot Via System Request Key - Rule", "ESCU - Linux Unix Shell Enable All SysRq Functions - Rule"]
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the AwfulShred malware including wiping files, process kill, system reboot via system request, shred,  and service stops.
+narrative = AwfulShred is a malicious linux shell script designed to corrupt or wipe the linux targeted system. It uses shred command to overwrite files and to increase data damage. This obfuscated malicious script can also disable and corrupts apache, HTTP and SSH services, deactivate swap files, clear bash history and finally reboot the system.
+
 [analytic_story://AWS Cross Account Activity]
 category = Cloud Security
 last_updated = 2018-06-04
@@ -12570,6 +12681,17 @@ searches = ["ESCU - Kubernetes AWS detect most active service accounts by pod -
 description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
 narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities

+[analytic_story://Lateral Movement]
+category = Adversary Tactics
+last_updated = 2020-02-04
+version = 2
+references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
+spec_version = 3
+searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"]
+description =  DEPRECATED IN FAVOR OF ACTIVE DIRECTORY LATERAL MOVEMENT. Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
+narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation. Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor. An adversary can use lateral movement for multiple purposes, including remote execution of tools, pivoting to additional systems, obtaining access to specific information or files, access to additional credentials, exfiltrating data, or delivering a secondary effect. Adversaries may use legitimate credentials alongside inherent network and operating-system functionality to remotely connect to other systems and remain under the radar of network defenders. If there is evidence of lateral movement, it is imperative for analysts to collect evidence of the associated offending hosts. For example, an attacker might leverage host A to gain access to host B. From there, the attacker may try to move laterally to host C. In this example, the analyst should gather as much information as possible from all three hosts. It is also important to collect authentication logs for each host, to ensure that the offending accounts are well-documented. Analysts should account for all processes to ensure that the attackers did not install unauthorized software.
+
 [analytic_story://Monitor Backup Solution]
 category = Best Practices
 last_updated = 2017-09-12
@@ -12811,6 +12933,17 @@ searches = ["ESCU - Check Elevated CMD using whoami - Rule", "ESCU - Cmdline Too
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated with its payload, data collection and script execution.
 narrative = FIN7 is a Russian criminal advanced persistent threat group that has primarily targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. A portion of FIN7 is run out of the front company Combi Security. It has been called one of the most successful criminal hacking groups in the world. this passed few day FIN7 tools and implant are seen in the wild where its code is updated. the FIN& is known to use the spear phishing attack as a entry to targetted network or host that will drop its staging payload like the JS and JSSloader. Now this artifacts and implants seen downloading other malware like cobaltstrike and event ransomware to encrypt host.

+[analytic_story://Fortinet FortiNAC CVE-2022-39952]
+category = Adversary Tactics
+last_updated = 2023-02-21
+version = 1
+references = ["https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/", "https://viz.greynoise.io/tag/fortinac-rce-attempt?days=30", "https://www.bleepingcomputer.com/news/security/fortinet-fixes-critical-rce-flaws-in-fortinac-and-fortiweb/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 - Rule"]
+description = On Thursday, 16 February 2022, Fortinet released a PSIRT that details CVE-2022-39952, a critical vulnerability affecting its FortiNAC product (Horizon3.ai).
+narrative = This vulnerability, discovered by Gwendal Guegniaud of Fortinet, allows an unauthenticated attacker to write arbitrary files on the system and as a result obtain remote code execution in the context of the root user (Horizon3.ai). Impacting FortiNAC, is tracked as CVE-2022-39952 and has a CVSS v3 score of 9.8 (critical). FortiNAC is a network access control solution that helps organizations gain real time network visibility, enforce security policies, and detect and mitigate threats. An external control of file name or path vulnerability CWE-73 in FortiNAC webserver may allow an unauthenticated attacker to perform arbitrary write on the system, reads the security advisory.
+
 [analytic_story://GCP Account Takeover]
 category = Account Compromise
 last_updated = 2022-10-12
@@ -13971,7 +14104,7 @@ version = 1
 references = ["https://attack.mitre.org/techniques/T1649/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Windows Export Certificate - Rule", "ESCU - Windows PowerShell Export Certificate - Rule", "ESCU - Windows PowerShell Export PfxCertificate - Rule", "ESCU - Windows Steal Authentication Certificates Certificate Issued - Rule", "ESCU - Windows Steal Authentication Certificates Certificate Request - Rule", "ESCU - Windows Steal Authentication Certificates CertUtil Backup - Rule", "ESCU - Windows Steal Authentication Certificates CS Backup - Rule", "ESCU - Windows Steal Authentication Certificates Export Certificate - Rule", "ESCU - Windows Steal Authentication Certificates Export PfxCertificate - Rule"]
+searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Windows Export Certificate - Rule", "ESCU - Windows Mimikatz Crypto Export File Extensions - Rule", "ESCU - Windows PowerShell Export Certificate - Rule", "ESCU - Windows PowerShell Export PfxCertificate - Rule", "ESCU - Windows Steal Authentication Certificates Certificate Issued - Rule", "ESCU - Windows Steal Authentication Certificates Certificate Request - Rule", "ESCU - Windows Steal Authentication Certificates CertUtil Backup - Rule", "ESCU - Windows Steal Authentication Certificates CryptoAPI - Rule", "ESCU - Windows Steal Authentication Certificates CS Backup - Rule", "ESCU - Windows Steal Authentication Certificates Export Certificate - Rule", "ESCU - Windows Steal Authentication Certificates Export PfxCertificate - Rule"]
 description = Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material.
 narrative = The following analytic story focuses on remote and local endpoint certificate theft and abuse. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs.With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. (MITRE ATT&CK)

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 12078
+build = 12157

 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple

 [launcher]
 author = Splunk
-version = 3.59.0
+version = 3.60.0
 description = Explore the Analytic Stories included with ES Content Updates.

 [ui]
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-14T17:42:34 UTC
+# On Date: 2023-02-21T20:55:18 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.59.0
+version = 3.60.0
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-14T17:42:34 UTC
+# On Date: 2023-02-21T20:55:18 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-14T17:42:34 UTC
+# On Date: 2023-02-21T20:55:18 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1941,6 +1941,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[linux_data_destruction_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [linux_dd_file_overwrite_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2021,6 +2025,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[linux_hardware_addition_swapoff_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [linux_high_frequency_of_file_deletion_in_boot_folder_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2029,6 +2037,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[linux_impair_defenses_process_kill_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_indicator_removal_clear_cache_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_indicator_removal_service_file_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [linux_ingress_tool_transfer_hunting_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2209,6 +2229,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[linux_system_reboot_via_system_request_key_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_unix_shell_enable_all_sysrq_functions_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [linux_visudo_utility_execution_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3565,6 +3593,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_mimikatz_crypto_export_file_extensions_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_modify_registry_default_icon_setting_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3921,6 +3953,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[windows_steal_authentication_certificates_cryptoapi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_steal_authentication_certificates_cs_backup_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4633,6 +4669,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[exploit_public_facing_fortinet_fortinac_cve_2022_39952_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [fortinet_appliance_auth_bypass_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4730,6 +4770,10 @@ description = This macro limits the output to only domains that are in the brand
 definition = lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true
 description = This macro limits the output to only domains that are in the brand monitoring lookup file

+[capi2_operational]
+definition = (source=XmlWinEventLog:Microsoft-Windows-CAPI2/Operational)
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [certificateservices_lifecycle]
 definition = (source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational OR source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational)
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-14T17:42:34 UTC
+# On Date: 2023-02-21T20:55:18 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-14T17:42:34 UTC
+# On Date: 2023-02-21T20:55:18 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 name: Detect Prohibited Applications Spawning cmd exe
 id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
-version: 3
+version: 4
 description: The following analytic identifies parent processes, browsers, Windows
  terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
  many applications spawn cmd.exe natively or built into macros. Much of this will
@@ -14,11 +14,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "string", null) | where process_name="cmd.exe" | rex field=parent_process_name "(?<ParentBaseFileName>[^\\\\]+)$"
  | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe"
  OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
-  OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
-  OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
-  AND (parent_process_name IS NOT NULL AND match_regex(parent_process_name, /(?i)patch1-Hotfix1a/)=false))
-  OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
-  IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)chrome-extension/)=false)))
+  OR ParentBaseFileName="msaccess.exe" OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe"
+  OR ParentBaseFileName="iexplore.exe" OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe"
+  OR (ParentBaseFileName="java.exe" AND (parent_process_name IS NOT NULL AND match_regex(parent_process_name,
+  /(?i)patch1-Hotfix1a/)=false)) OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe"
+  AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)chrome-extension/)=false)))
  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
  dest_user_id), body=create_map(["event_id", event_id,  "process_name", process_name,
  "parent_process_name", parent_process_name, "cmd_line", cmd_line, "ParentBaseFileName",
@@ -1,6 +1,6 @@
 name: Office Product Spawning Windows Script Host
 id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6
-version: 1
+version: 2
 description: The following analytic will identify a Windows Office Product spawning
  WScript.exe or CScript.exe. Tuning may be required based on legitimate application
  usage that may spawn scripts from an Office product.
@@ -13,12 +13,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name
  IS NOT NULL | where (like(parent_process_name, "%\\\\winword.exe") OR like(parent_process_name,
  "%\\\\excel.exe") OR like(parent_process_name, "%\\\\powerpnt.exe") OR like(parent_process_name,
-  "%\\\\mspub.exe") OR like(parent_process_name, "%\\\\visio.exe")) AND (process_name="wscript.exe"
-  OR process_name="cscript.exe") | eval start_time=timestamp, end_time=timestamp,
-  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
-  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
-  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
-  "process_path", process_path]) | into write_ssa_detected_events();'
+  "%\\\\mspub.exe") OR like(parent_process_name, "%\\\\visio.exe") OR like(parent_process_name,
+  "%\\\\msaccess.exe")) AND (process_name="wscript.exe" OR process_name="cscript.exe")
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the