From cda8da91ac08eeca40917cea8f36b020fab85c71 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 27 Mar 2025 11:27:43 -0700 Subject: [PATCH] updating detections version --- detections/endpoint/detect_rclone_command_line_usage.yml | 4 ++-- ...licious_powershell_process___execution_policy_bypass.yml | 2 +- .../endpoint/remote_process_instantiation_via_wmi.yml | 6 +++--- .../remote_process_instantiation_via_wmi_and_powershell.yml | 2 +- detections/endpoint/spoolsv_writing_a_dll___sysmon.yml | 6 +++--- .../endpoint/windows_svchost_exe_parent_process_anomaly.yml | 2 +- detections/endpoint/windows_unsigned_dll_side_loading.yml | 2 +- ...ndows_unsigned_dll_side_loading_in_same_process_path.yml | 2 +- .../endpoint/windows_unsigned_ms_dll_side_loading.yml | 2 +- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 18860d8394..0cca827775 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -1,7 +1,7 @@ name: Detect RClone Command-Line Usage id: 32e0baea-b3f1-11eb-a2ce-acde48001122 -version: '8' -date: '2025-03-03' +version: '9' +date: '2025-03-27' author: Michael Haag, Splunk status: production type: TTP diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 82e4313070..32757b4ae4 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,6 +1,6 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -version: '11' +version: '12' date: '2025-02-24' author: Rico Valdez, Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 1580996916..8c6f4613b2 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -1,8 +1,8 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -version: '12' -date: '2025-02-24' -author: Rico Valdez, Mauricio Velazco, Splunk +version: '13' +date: '2025-03-27' +author: Mauricio Velazco, Splunk status: production type: TTP description: The following analytic detects the execution of wmic.exe with parameters diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml index c2b3f9308f..384c412a26 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml @@ -1,6 +1,6 @@ name: Remote Process Instantiation via WMI and PowerShell id: 112638b4-4634-11ec-b9ab-3e22fbd008af -version: 13 +version: 15 date: '2025-03-27' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index 9fdd44624b..04f1f2476a 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -1,8 +1,8 @@ name: Spoolsv Writing a DLL - Sysmon id: 347fd388-da87-11eb-836d-acde48001122 -version: '6' -date: '2025-03-03' -author: Mauricio Velazco, Michael Haag, Splunk +version: '7' +date: '2025-03-27' +author: Mauricio Velazco, Splunk status: production type: TTP description: The following analytic detects `spoolsv.exe` writing a `.dll` file, which diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml index 66fc428eab..05d0308842 100644 --- a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml +++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml @@ -1,6 +1,6 @@ name: Windows Svchost.exe Parent Process Anomaly id: 1d38e5e9-2ff8-4c47-872c-bf1657cefab5 -version: 1 +version: 2 date: '2025-02-11' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index c903159a1c..90e2892c28 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -1,6 +1,6 @@ name: Windows Unsigned DLL Side-Loading id: 5a83ce44-8e0f-4786-a775-8249a525c879 -version: '8' +version: '9' date: '2025-02-24' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index db06f4ae84..b0c9369d68 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -1,6 +1,6 @@ name: Windows Unsigned DLL Side-Loading In Same Process Path id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f -version: 8 +version: 9 date: '2025-02-26' author: Teoderick Contreras, Splunk data_source: diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 9bd0d4ce3f..5bb4b7e9cd 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -1,6 +1,6 @@ name: Windows Unsigned MS DLL Side-Loading id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c -version: '8' +version: '9' date: '2025-02-24' author: Teoderick Contreras, Splunk data_source: