Branch was auto-updated.

detections/endpoint/certutil_exe_certificate_extraction.yml

@@ -28,6 +28,7 @@ tags:
   - Windows Persistence Techniques
   - Cloud Federated Credential Abuse
   - Living Off The Land
+  - Windows Certificate Services
   asset_type: Endpoint
   confidence: 70
   context:

detections/endpoint/windows_export_certificate.yml

@@ -0,0 +1,56 @@
+name: Windows Export Certificate
+id: d8ddfa9b-b724-4df9-9dbe-f34cc0936714
+version: 1
+date: '2023-01-27'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies when a certificate is exported from the Windows Certificate Store. This analytic utilizes the Certificates Lifecycle log channel event ID 1007. EventID 1007 is focused on the Export of a certificate from the local certificate store. In addition, review the ProcessName field as it will help to determine automation/Admin or adversary extracting the certificate.
+  Depending on the organization, the certificate may be used for authentication to the VPN or private resources. 
+search: '`certificateservices_lifecycle`
+  | xmlkv UserData_Xml
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SubjectName, UserData_Xml
+  | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_export_certificate_filter`'
+how_to_implement: To implement this analytic, you must collect Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational or Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational. 
+known_false_positives: False positives may be generated based on an automated process or service that exports certificates on the regular. Review is required before setting to alert. Monitor for abnormal processes performing an export.
+references:
+- https://atomicredteam.io/defense-evasion/T1553.004/#atomic-test-4---install-root-ca-on-windows
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/certificateservices-lifecycle.log
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An certificate was exported on $dest$ from the Windows Certificate Store.
+  mitre_attack_id:
+  - T1552.004
+  - T1552
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - SubjectName
+  - UserData_Xml
+  risk_score: 36
+  security_domain: endpoint

detections/endpoint/windows_powershell_export_certificate.yml

@@ -0,0 +1,58 @@
+name: Windows PowerShell Export Certificate
+id: 5e38ded4-c964-41f4-8cb6-4a1a53c6929f
+version: 1
+date: '2023-02-01'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies the PowerShell Cmdlet export-certificate utilizing Script Block Logging. This particular behavior is related to an adversary attempting to steal certificates local to the Windows endpoint within the Certificate Store.
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*export-certificate*") | rename Computer as dest  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_powershell_export_certificate_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest$, attempting to export a certificate.
+  mitre_attack_id:
+  - T1552.004
+  - T1552
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - dest
+  - EventCode
+  risk_score: 36
+  security_domain: endpoint

detections/endpoint/windows_powershell_export_pfxcertificate.yml

@@ -0,0 +1,58 @@
+name: Windows PowerShell Export PfxCertificate
+id: ed06725f-6da6-439f-9dcc-ab30e891297c
+version: 1
+date: '2023-02-01'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate utilizing Script Block Logging. This particular behavior is related to an adversary attempting to steal certificates local to the Windows endpoint within the Certificate Store.
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*export-pfxcertificate*") | rename Computer as dest  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_powershell_export_pfxcertificate_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate.log
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A PowerShell Cmdlet related to exporting a PFX Certificate was ran on $dest$, attempting to export a certificate.
+  mitre_attack_id:
+  - T1552.004
+  - T1552
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - dest
+  - EventCode
+  risk_score: 36
+  security_domain: endpoint

detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml

@@ -0,0 +1,54 @@
+name: Windows Steal Authentication Certificates Certificate Issued
+id: 9b1a5385-0c31-4c39-9753-dc26b8ce64c2
+version: 1
+date: '2023-02-06'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description:  The following analytic identifies when a new certificate is issued against the Certificate Services - AD CS. By its very nature this is not malicious, but should be tracked and correlated with other events related to certificates being issued.
+  When the CA issues the certificate, it creates EID 4887 'Certificate Services approved a certificate request and issued a certificate".
+  The event supplies the requester user context, the DNS hostname of the machine they requested the certificate from, and the time they requested the certificate. The attributes fields in these event commonly has values for CDC, RMD, and CCM which correspond to Client DC, Request Machine DNS name, and Cert Client Machine, respectively.
+search: '`wineventlog_security`  EventCode=4887 | stats count min(_time) as firstTime max(_time) as lastTime by dest, name, Requester, action, Attributes, Subject | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_steal_authentication_certificates_certificate_issued_filter`'
+how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference.
+known_false_positives: False positives will be generated based on normal certificates issued. Leave enabled to generate Risk, as this is meant to be an anomaly analytic.
+references:
+- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4887_windows-security.log
+  impact: 10
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A certificate was issued to $dest$.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - name
+  - Requester
+  - action
+  - Attributes
+  risk_score: 8
+  security_domain: endpoint

detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml

@@ -0,0 +1,53 @@
+name: Windows Steal Authentication Certificates Certificate Request
+id: 747d7800-2eaa-422d-b994-04d8bb9e06d0
+version: 1
+date: '2023-02-06'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies when a new certificate is requested against the Certificate Services - AD CS. By its very nature this is not malicious, but should be tracked and correlated with other events related to certificate requests.
+  When an account requests a certificate, the CA generates event ID (EID) 4886 "Certificate Services received a certificate request".
+search: '`wineventlog_security` EventCode=4886 | stats count min(_time) as firstTime max(_time) as lastTime by dest, name, Requester, action, Attributes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_certificate_request_filter`'
+how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference.
+known_false_positives: False positives will be generated based on normal certificate requests. Leave enabled to generate Risk, as this is meant to be an anomaly analytic.
+references:
+- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4886_windows-security.log
+  impact: 10
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A certificate was requested by $dest$.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - name
+  - Requester
+  - action
+  - Attributes
+  risk_score: 8
+  security_domain: endpoint

detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml

@@ -0,0 +1,78 @@
+name: Windows Steal Authentication Certificates CertUtil Backup
+id: bac85b56-0b65-4ce5-aad5-d94880df0967
+version: 1
+date: '2023-02-06'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic is focused on CertUtil.exe performing a backup of the Certificate Store. 
+  Typically, administrators may perform this task to migrate or perform backups of the store, however it may be found uncommon in most organizations.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil`
+  Processes.process IN ("*-backupdb *", "*-backup *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_certutil_backup_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be generated based on normal certificate store backups. Leave enabled to generate Risk, as this is meant to be an anomaly analytic. If CS backups are not normal, enable as TTP. 
+references:
+- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/backupdb_certutil_windows-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to backup the Certificate Store.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 40
+  security_domain: endpoint

detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml

@@ -0,0 +1,52 @@
+name: Windows Steal Authentication Certificates CS Backup
+id: a2f4cc7f-6503-4078-b206-f83a29f408a7
+version: 1
+date: '2023-02-06'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies when the Active Directory Certificate Services store is backed up utilizing Event ID 4876. This event triggers whenever the backup occurs in the UI of CertSrv.msc or via CertUtil.exe -BackupDB occurs. 
+search: '`wineventlog_security` EventCode=4876| stats count min(_time) as firstTime max(_time) as lastTime by dest, name, action, Caller_Domain ,Caller_User_Name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_cs_backup_filter`'
+how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 128 of first reference.
+known_false_positives: False positives will be generated based on normal certificate store backups. Leave enabled to generate Risk, as this is meant to be an anomaly analytic. If CS backups are not normal, enable as TTP. 
+references:
+- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4876_windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: The Active Directory Certiciate Services was backed up on $dest$.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - name
+  - action
+  - Caller_Domain
+  - Caller_User_Name
+  risk_score: 40
+  security_domain: endpoint

detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml

@@ -0,0 +1,81 @@
+name: Windows Steal Authentication Certificates Export Certificate
+id: e39dc429-c2a5-4f1f-9c3c-6b211af6b332
+version: 1
+date: '2023-02-01'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of export-certificate, the PowerShell cmdlet, being utilized on the command-line in an attempt to export the certifcate from the local Windows Certificate Store.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where 
+  Processes.process="*export-certificate*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_export_certificate_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Filtering may be requried based on automated utilities and third party applications that may export certificates. 
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export a certificate from the local Windows Certificate Store.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 36
+  security_domain: endpoint

detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml

@@ -0,0 +1,81 @@
+name: Windows Steal Authentication Certificates Export PfxCertificate
+id: 391329f3-c14b-4b8d-8b37-ac5012637360
+version: 1
+date: '2023-02-01'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of export-pfxcertificate, the PowerShell cmdlet, being utilized on the command-line in an attempt to export the certifcate from the local Windows Certificate Store.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where 
+  Processes.process="*export-pfxcertificate*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_export_pfxcertificate_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Filtering may be requried based on automated utilities and third party applications that may export certificates. 
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_pfxcertificate_windows-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export a certificate from the local Windows Certificate Store.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 36
+  security_domain: endpoint

detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml

@@ -1,6 +1,6 @@
 name: WinEvent Scheduled Task Created to Spawn Shell
 id: 203ef0ea-9bd8-11eb-8201-acde48001122
-version: 1
+version: 2
 date: '2021-04-12'
 author: Michael Haag, Splunk
 type: TTP
@@ -9,17 +9,13 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with a command to be executed with a native Windows
   shell (PowerShell, Cmd, Wscript, Cscript).\
-
   The search will return the first time and last time the task was registered, as
   well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
   it is `Hidden` or not.\
-
   schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\
-
   The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`.
   If found loaded by another process, it is possible a scheduled task is being registered
   within that process context in memory.\
-
   Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService?
   Review the job created and the Command to be executed. Capture any artifacts on
   disk and review. Identify any parallel processes within the same timeframe to identify
@@ -84,4 +80,4 @@ tags:
   - Command
   risk_score: 70
   security_domain: endpoint
-  asset_type: Endpoint
+  asset_type: Endpoint

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -9,17 +9,13 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with a command to be executed from a user writeable
   file path.\
-
   The search will return the first time and last time the task was registered, as
   well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
   it is `Hidden` or not.\
-
   schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\
-
   The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`.
   If found loaded by another process, it is possible a scheduled task is being registered
   within that process context in memory.\
-
   Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via
   TaskService. Review the job created and the Command to be executed. Capture any
   artifacts on disk and review. Identify any parallel processes within the same timeframe
@@ -89,4 +85,4 @@ tags:
   - Command
   risk_score: 70
   security_domain: endpoint
-  asset_type: Endpoint
+  asset_type: Endpoint

detections/experimental/endpoint/windows_driver_inventory.yml

@@ -0,0 +1,53 @@
+name: Windows Driver Inventory
+id: f87aa96b-369b-4a3e-9021-1bbacbfcb8fb
+version: 1
+date: '2023-02-03'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: The following hunting / inventory query assists defenders in identifying Drivers being loaded across the fleet. This query relies upon a PowerShell script input to be deployed to critical systems and beyond. If capturing all via the input, this will provide retrospection into drivers persisting. 
+  Note, that this is not perfect across a large fleet. Modify the query as you need to view the data differently. 
+search: '`driverinventory` | stats values(Path) min(_time) as firstTime max(_time) as lastTime count by host DriverType | rename host as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_driver_inventory_filter`'
+how_to_implement: To capture the drivers by host, utilize the referenced Gist to create the inputs, props and transforms. Otherwise, this hunt query will not work. 
+known_false_positives: Filter and modify the analytic as you'd like. Filter based on path. Remove the system32\drivers and look for non-standard paths.
+references:
+  - https://gist.github.com/MHaggis/3e4dc85c69b3f7a4595a06c8a692f244
+tags:
+  analytic_story:
+  - Windows Drivers
+  asset_type: endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 10
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/driver_inventory.log
+  impact: 50
+  kill_chain_phases:
+  - Installation
+  message: Drivers have been identified on $dest$.
+  mitre_attack_id:
+  - T1068
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Path
+  - host 
+  - DriverType
+  risk_score: 5
+  security_domain: endpoint
+  developer_comments: Needs custom Props/Transforms. Details are in How to Implement.

detections/experimental/endpoint/windows_java_spawning_shells.yml

@@ -1,7 +1,7 @@
 name: Windows Java Spawning Shells
 id: 28c81306-5c47-11ec-bfea-acde48001122
-version: 1
-date: '2021-12-13'
+version: 2
+date: '2023-01-23'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -28,6 +28,10 @@ known_false_positives: Filtering may be required on internal developer build sys
 references:
 - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
 - https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
+- https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
+- https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py
+- https://blog.viettelcybersecurity.com/saml-show-stopper/
+- https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
@@ -38,6 +42,7 @@ tags:
   - Stage:Defense Evasion
   cve:
   - CVE-2021-44228
+  - CVE-2022-47966
   dataset: []
   impact: 80
   kill_chain_phases:

detections/web/exploit_public_facing_application_via_apache_commons_text.yml

@@ -1,7 +1,7 @@
 name: Exploit Public Facing Application via Apache Commons Text
 id: 19a481e0-c97c-4d14-b1db-75a708eb592e
-version: 1
-date: '2022-10-26'
+version: 2
+date: '2023-01-23'
 author: Michael Haag, Splunk
 type: Anomaly
 datamodel:
@@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `drop_dm_object_name("Web")`
   | eval utf=if(like(lower(uri_query),"%:utf-8:http%"),2,0)
   | eval lookup = if(like(lower(uri_query), "%url%") OR like(lower(uri_query), "%dns%") OR like(lower(uri_query), "%script%"),2,0)
-  | eval other_lookups = if(like(lower(uri_query), "%env%") OR like(lower(uri_query), "%file%") OR like(lower(uri_query), "%java%") OR like(lower(uri_query), "%localhost%") OR like(lower(uri_query), "%properties%") OR like(lower(uri_query), "%resource%") OR like(lower(uri_query), "%sys%") OR like(lower(uri_query), "%xml%") OR like(lower(uri_query), "%base%"),1,0)
+  | eval other_lookups = if(like(lower(uri_query), "%env%") OR like(lower(uri_query), "%file%") OR like(lower(uri_query), "%getRuntime%") OR like(lower(uri_query), "%java%") OR like(lower(uri_query), "%localhost%") OR like(lower(uri_query), "%properties%") OR like(lower(uri_query), "%resource%") OR like(lower(uri_query), "%sys%") OR like(lower(uri_query), "%xml%") OR like(lower(uri_query), "%base%"),1,0)
   | addtotals fieldname=Score utf lookup other_lookups
   | fields Score, src, dest, status, uri_query, uri_path, http_method, http_user_agent firstTime lastTime
   | `security_content_ctime(firstTime)`
@@ -28,6 +28,8 @@ references:
   - https://nvd.nist.gov/vuln/detail/CVE-2022-42889
   - https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
   - https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/
+  - https://github.com/kljunowsky/CVE-2022-42889-text4shell
+  - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035
 tags:
   analytic_story:
   - Text4Shell CVE-2022-42889

macros/certificateservices_lifecycle.yml

@@ -0,0 +1,4 @@
+definition: (source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational OR source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational)
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: certificateservices_lifecycle

macros/driverinventory.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=PwSh:DriverInventory
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: driverinventory

macros/windows_shells.yml

@@ -1,4 +1,4 @@
-definition: (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe)
+definition: (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=sh.exe OR Processes.process_name=bash.exe OR Processes.process_name=wscript.exe OR Processes.process_name=cscript.exe)
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
 name: windows_shells

stories/windows_certificate_services.yml

@@ -0,0 +1,18 @@
+name: Windows Certificate Services
+id: b92b4ac7-0026-4408-a6b5-c1d20658e124
+version: 1
+date: '2023-02-01'
+author: Michael Haag, Splunk
+description: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material.
+narrative: The following analytic story focuses on remote and local endpoint certificate theft and abuse. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs.With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. (MITRE ATT&CK)
+references:
+  - https://attack.mitre.org/techniques/T1649/
+tags:
+  analytic_story: Windows Certificate Services
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/windows_export_certificate.test.yml

@@ -0,0 +1,13 @@
+name: Windows Export Certificate Unit Test
+tests:
+- name: Windows Export Certificate
+  file: endpoint/windows_export_certificate.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: certificateservices-lifecycle.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/certificateservices-lifecycle.log
+    source: XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/windows_powershell_export_certificate.test.yml

@@ -0,0 +1,13 @@
+name: Windows PowerShell Export PfxCertificate Unit Test
+tests:
+- name: Windows PowerShell Export PfxCertificate
+  file: endpoint/windows_powershell_export_certificate.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4104_export_certificate.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_powershell_export_pfxcertificate.test.yml

@@ -0,0 +1,13 @@
+name: Windows PowerShell Export PfxCertificate Unit Test
+tests:
+- name: Windows PowerShell Export PfxCertificate
+  file: endpoint/windows_powershell_export_pfxcertificate.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4104_export_pfxcertificate.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_steal_authentication_certificates_certificate_issued.test.yml

@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates Certificate Issued Unit Test
+tests:
+- name: Windows Steal Authentication Certificates Certificate Issued
+  file: endpoint/windows_steal_authentication_certificates_certificate_issued.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4887_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4887_windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/windows_steal_authentication_certificates_certificate_request.test.yml

@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates Certificate Request Unit Test
+tests:
+- name: Windows Steal Authentication Certificates Certificate Request
+  file: endpoint/windows_steal_authentication_certificates_certificate_request.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4886_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4886_windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/windows_steal_authentication_certificates_certutil_backup.test.yml

@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates CertUtil Backup Unit Test
+tests:
+- name: Windows Steal Authentication Certificates CertUtil Backup
+  file: endpoint/windows_steal_authentication_certificates_certutil_backup.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: backupdb_certutil_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/backupdb_certutil_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_steal_authentication_certificates_cs_backup.test.yml

@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates CS Backup Unit Test
+tests:
+- name: Windows Steal Authentication Certificates CS Backup
+  file: endpoint/windows_steal_authentication_certificates_cs_backup.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4876_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4876_windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/windows_steal_authentication_certificates_export_certificate.test.yml

@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates Export Certificate Unit Test
+tests:
+- name: Windows Steal Authentication Certificates Export Certificate
+  file: endpoint/windows_steal_authentication_certificates_export_certificate.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: export_certificate_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.test.yml

@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates Export PfxCertificate Unit Test
+tests:
+- name: Windows Steal Authentication Certificates Export PfxCertificate
+  file: endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: export_pfxcertificate_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_pfxcertificate_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml

@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-sysmon.log
+  - file_name: windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog

tests/experimental/endpoint/windows_driver_inventory.test.yml

@@ -0,0 +1,13 @@
+name: Windows Driver Inventory Unit Test
+tests:
+- name: Windows Driver Inventory
+  file: experimental/endpoint/windows_driver_inventory.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: driver_inventory.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/driver_inventory.log
+    source: PwSh:DriverInventory
+    sourcetype: PwSh:DriverInventory
+    update_timestamp: true