From af8cd582e42e22dbb1fbacc91e9f769e44d3b490 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 24 Jan 2023 14:41:22 -0700
Subject: [PATCH 01/15] dropping some updates

---
 .../endpoint/windows_java_spawning_shells.yml            | 9 +++++++--
 ...public_facing_application_via_apache_commons_text.yml | 8 +++++---
 macros/windows_shells.yml                                | 2 +-
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/detections/experimental/endpoint/windows_java_spawning_shells.yml b/detections/experimental/endpoint/windows_java_spawning_shells.yml
index cd3ce4774a..11767859a1 100644
--- a/detections/experimental/endpoint/windows_java_spawning_shells.yml
+++ b/detections/experimental/endpoint/windows_java_spawning_shells.yml
@@ -1,7 +1,7 @@
 name: Windows Java Spawning Shells
 id: 28c81306-5c47-11ec-bfea-acde48001122
-version: 1
-date: '2021-12-13'
+version: 2
+date: '2023-01-23'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -28,6 +28,10 @@ known_false_positives: Filtering may be required on internal developer build sys
 references:
 - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
 - https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
+- https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
+- https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py
+- https://blog.viettelcybersecurity.com/saml-show-stopper/
+- https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
@@ -38,6 +42,7 @@ tags:
   - Stage:Defense Evasion
   cve:
   - CVE-2021-44228
+  - CVE-2022-47966
   dataset: []
   impact: 80
   kill_chain_phases:
diff --git a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml
index 218fa62d57..31347b42a4 100644
--- a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml
+++ b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml
@@ -1,7 +1,7 @@
 name: Exploit Public Facing Application via Apache Commons Text
 id: 19a481e0-c97c-4d14-b1db-75a708eb592e
-version: 1
-date: '2022-10-26'
+version: 2
+date: '2023-01-23'
 author: Michael Haag, Splunk
 type: Anomaly
 datamodel:
@@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `drop_dm_object_name("Web")`
   | eval utf=if(like(lower(uri_query),"%:utf-8:http%"),2,0)
   | eval lookup = if(like(lower(uri_query), "%url%") OR like(lower(uri_query), "%dns%") OR like(lower(uri_query), "%script%"),2,0)
-  | eval other_lookups = if(like(lower(uri_query), "%env%") OR like(lower(uri_query), "%file%") OR like(lower(uri_query), "%java%") OR like(lower(uri_query), "%localhost%") OR like(lower(uri_query), "%properties%") OR like(lower(uri_query), "%resource%") OR like(lower(uri_query), "%sys%") OR like(lower(uri_query), "%xml%") OR like(lower(uri_query), "%base%"),1,0)
+  | eval other_lookups = if(like(lower(uri_query), "%env%") OR like(lower(uri_query), "%file%") OR like(lower(uri_query), "%getRuntime%") OR like(lower(uri_query), "%java%") OR like(lower(uri_query), "%localhost%") OR like(lower(uri_query), "%properties%") OR like(lower(uri_query), "%resource%") OR like(lower(uri_query), "%sys%") OR like(lower(uri_query), "%xml%") OR like(lower(uri_query), "%base%"),1,0)
   | addtotals fieldname=Score utf lookup other_lookups
   | fields Score, src, dest, status, uri_query, uri_path, http_method, http_user_agent firstTime lastTime
   | `security_content_ctime(firstTime)`
@@ -28,6 +28,8 @@ references:
   - https://nvd.nist.gov/vuln/detail/CVE-2022-42889
   - https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
   - https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/
+  - https://github.com/kljunowsky/CVE-2022-42889-text4shell
+  - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035
 tags:
   analytic_story:
   - Text4Shell CVE-2022-42889
diff --git a/macros/windows_shells.yml b/macros/windows_shells.yml
index 847a67a5d5..3978d891a5 100644
--- a/macros/windows_shells.yml
+++ b/macros/windows_shells.yml
@@ -1,4 +1,4 @@
-definition: (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe)
+definition: (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=sh.exe)
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
 name: windows_shells

From 3db30e0ba16315e8a5fa109052751ee5c0ae6d7b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 26 Jan 2023 15:21:15 -0700
Subject: [PATCH 02/15] Update windows_shells.yml

---
 macros/windows_shells.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/macros/windows_shells.yml b/macros/windows_shells.yml
index 3978d891a5..b7f6a287d6 100644
--- a/macros/windows_shells.yml
+++ b/macros/windows_shells.yml
@@ -1,4 +1,4 @@
-definition: (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=sh.exe)
+definition: (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=sh.exe OR Processes.process_name=bash.exe OR Processes.process_name=wscript.exe OR Processes.process_name=cscript.exe)
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
 name: windows_shells

From ebc91326ecae4391e812ad4c8dd3bf3b4cd969c7 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 3 Feb 2023 06:58:50 -0700
Subject: [PATCH 03/15] Cert services and MOAR

---
 .../certutil_exe_certificate_extraction.yml   |  1 +
 .../endpoint/windows_export_certificate.yml   | 56 +++++++++++++
 .../windows_powershell_export_certificate.yml | 58 +++++++++++++
 ...ndows_powershell_export_pfxcertificate.yml | 58 +++++++++++++
 ...cation_certificates_export_certificate.yml | 81 +++++++++++++++++++
 ...ion_certificates_export_pfxcertificate.yml | 81 +++++++++++++++++++
 macros/certificateservices_lifecycle.yml      |  4 +
 stories/windows_certificate_services.yml      | 18 +++++
 .../windows_export_certificate.test.yml       | 13 +++
 ...ows_powershell_export_certificate.test.yml | 13 +++
 ..._powershell_export_pfxcertificate.test.yml | 13 +++
 ...n_certificates_export_certificate.test.yml | 13 +++
 ...ertificates_export_pfxcertificate.test.yml | 13 +++
 13 files changed, 422 insertions(+)
 create mode 100644 detections/endpoint/windows_export_certificate.yml
 create mode 100644 detections/endpoint/windows_powershell_export_certificate.yml
 create mode 100644 detections/endpoint/windows_powershell_export_pfxcertificate.yml
 create mode 100644 detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml
 create mode 100644 detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml
 create mode 100644 macros/certificateservices_lifecycle.yml
 create mode 100644 stories/windows_certificate_services.yml
 create mode 100644 tests/endpoint/windows_export_certificate.test.yml
 create mode 100644 tests/endpoint/windows_powershell_export_certificate.test.yml
 create mode 100644 tests/endpoint/windows_powershell_export_pfxcertificate.test.yml
 create mode 100644 tests/endpoint/windows_steal_authentication_certificates_export_certificate.test.yml
 create mode 100644 tests/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.test.yml

diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml
index 186b04b778..9d725fd991 100644
--- a/detections/endpoint/certutil_exe_certificate_extraction.yml
+++ b/detections/endpoint/certutil_exe_certificate_extraction.yml
@@ -28,6 +28,7 @@ tags:
   - Windows Persistence Techniques
   - Cloud Federated Credential Abuse
   - Living Off The Land
+  - Windows Certificate Services
   asset_type: Endpoint
   confidence: 70
   context:
diff --git a/detections/endpoint/windows_export_certificate.yml b/detections/endpoint/windows_export_certificate.yml
new file mode 100644
index 0000000000..d0c7ebaa63
--- /dev/null
+++ b/detections/endpoint/windows_export_certificate.yml
@@ -0,0 +1,56 @@
+name: Windows Export Certificate
+id: d8ddfa9b-b724-4df9-9dbe-f34cc0936714
+version: 1
+date: '2023-01-27'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies when a certificate is exported from the Windows Certificate Store. This analytic utilizes the Certificates Lifecycle log channel event ID 1007. EventID 1007 is focused on the Export of a certificate from the local certificate store. In addition, review the ProcessName field as it will help to determine automation/Admin or adversary extracting the certificate.
+  Depending on the organization, the certificate may be used for authentication to the VPN or private resources. 
+search: '`certificateservices_lifecycle`
+  | xmlkv UserData_Xml
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SubjectName, UserData_Xml
+  | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_export_certificate_filter`'
+how_to_implement: To implement this analytic, you must collect Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational or Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational. 
+known_false_positives: False positives may be generated based on an automated process or service that exports certificates on the regular. Review is required before setting to alert. Monitor for abnormal processes performing an export.
+references:
+- https://atomicredteam.io/defense-evasion/T1553.004/#atomic-test-4---install-root-ca-on-windows
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/certificateservices-lifecycle.log
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An certificate was exported on $dest$ from the Windows Certificate Store.
+  mitre_attack_id:
+  - T1552.004
+  - T1552
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - SubjectName
+  - UserData_Xml
+  risk_score: 36
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_powershell_export_certificate.yml b/detections/endpoint/windows_powershell_export_certificate.yml
new file mode 100644
index 0000000000..0752faebf7
--- /dev/null
+++ b/detections/endpoint/windows_powershell_export_certificate.yml
@@ -0,0 +1,58 @@
+name: Windows PowerShell Export Certificate
+id: 5e38ded4-c964-41f4-8cb6-4a1a53c6929f
+version: 1
+date: '2023-02-01'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies the PowerShell Cmdlet export-certificate utilizing Script Block Logging. This particular behavior is related to an adversary attempting to steal certificates local to the Windows endpoint within the Certificate Store.
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*export-certificate*") | rename Computer as dest  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_powershell_export_certificate_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest$, attempting to export a certificate.
+  mitre_attack_id:
+  - T1552.004
+  - T1552
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - dest
+  - EventCode
+  risk_score: 36
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_powershell_export_pfxcertificate.yml b/detections/endpoint/windows_powershell_export_pfxcertificate.yml
new file mode 100644
index 0000000000..127e8776a6
--- /dev/null
+++ b/detections/endpoint/windows_powershell_export_pfxcertificate.yml
@@ -0,0 +1,58 @@
+name: Windows PowerShell Export PfxCertificate
+id: ed06725f-6da6-439f-9dcc-ab30e891297c
+version: 1
+date: '2023-02-01'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate utilizing Script Block Logging. This particular behavior is related to an adversary attempting to steal certificates local to the Windows endpoint within the Certificate Store.
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*export-pfxcertificate*") | rename Computer as dest  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_powershell_export_pfxcertificate_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate.log
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A PowerShell Cmdlet related to exporting a PFX Certificate was ran on $dest$, attempting to export a certificate.
+  mitre_attack_id:
+  - T1552.004
+  - T1552
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - dest
+  - EventCode
+  risk_score: 36
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml
new file mode 100644
index 0000000000..678dd28ce9
--- /dev/null
+++ b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml
@@ -0,0 +1,81 @@
+name: Windows Steal Authentication Certificates Export Certificate
+id: e39dc429-c2a5-4f1f-9c3c-6b211af6b332
+version: 1
+date: '2023-02-01'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of export-certificate, the PowerShell cmdlet, being utilized on the command-line in an attempt to export the certifcate from the local Windows Certificate Store.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where 
+  Processes.process="*export-certificate*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_export_certificate_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Filtering may be requried based on automated utilities and third party applications that may export certificates. 
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export a certificate from the local Windows Certificate Store.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 36
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml
new file mode 100644
index 0000000000..518a21c965
--- /dev/null
+++ b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml
@@ -0,0 +1,81 @@
+name: Windows Steal Authentication Certificates Export PfxCertificate
+id: 391329f3-c14b-4b8d-8b37-ac5012637360
+version: 1
+date: '2023-02-01'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of export-pfxcertificate, the PowerShell cmdlet, being utilized on the command-line in an attempt to export the certifcate from the local Windows Certificate Store.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where 
+  Processes.process="*export-pfxcertificate*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_export_pfxcertificate_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Filtering may be requried based on automated utilities and third party applications that may export certificates. 
+references:
+- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
+- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_pfxcertificate_windows-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export a certificate from the local Windows Certificate Store.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 36
+  security_domain: endpoint
\ No newline at end of file
diff --git a/macros/certificateservices_lifecycle.yml b/macros/certificateservices_lifecycle.yml
new file mode 100644
index 0000000000..38a1f784ba
--- /dev/null
+++ b/macros/certificateservices_lifecycle.yml
@@ -0,0 +1,4 @@
+definition: (source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational OR source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational)
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: certificateservices_lifecycle
\ No newline at end of file
diff --git a/stories/windows_certificate_services.yml b/stories/windows_certificate_services.yml
new file mode 100644
index 0000000000..3b37749216
--- /dev/null
+++ b/stories/windows_certificate_services.yml
@@ -0,0 +1,18 @@
+name: Windows Certificate Services
+id: b92b4ac7-0026-4408-a6b5-c1d20658e124
+version: 1
+date: '2023-02-01'
+author: Michael Haag, Splunk
+description: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material.
+narrative: The following analytic story focuses on remote and local endpoint certificate theft and abuse. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs.With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. (MITRE ATT&CK)
+references:
+  - https://attack.mitre.org/techniques/T1649/
+tags:
+  analytic_story: Windows Certificate Services
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
diff --git a/tests/endpoint/windows_export_certificate.test.yml b/tests/endpoint/windows_export_certificate.test.yml
new file mode 100644
index 0000000000..262d9d094e
--- /dev/null
+++ b/tests/endpoint/windows_export_certificate.test.yml
@@ -0,0 +1,13 @@
+name: Windows Export Certificate Unit Test
+tests:
+- name: Windows Export Certificate
+  file: endpoint/windows_export_certificate.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: certificateservices-lifecycle.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/certificateservices-lifecycle.log
+    source: XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/windows_powershell_export_certificate.test.yml b/tests/endpoint/windows_powershell_export_certificate.test.yml
new file mode 100644
index 0000000000..fa0eef21ec
--- /dev/null
+++ b/tests/endpoint/windows_powershell_export_certificate.test.yml
@@ -0,0 +1,13 @@
+name: Windows PowerShell Export PfxCertificate Unit Test
+tests:
+- name: Windows PowerShell Export PfxCertificate
+  file: endpoint/windows_powershell_export_pfxcertificate.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4104_export_certificate.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_powershell_export_pfxcertificate.test.yml b/tests/endpoint/windows_powershell_export_pfxcertificate.test.yml
new file mode 100644
index 0000000000..c1c0c11c48
--- /dev/null
+++ b/tests/endpoint/windows_powershell_export_pfxcertificate.test.yml
@@ -0,0 +1,13 @@
+name: Windows PowerShell Export PfxCertificate Unit Test
+tests:
+- name: Windows PowerShell Export PfxCertificate
+  file: endpoint/windows_powershell_export_pfxcertificate.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4104_export_pfxcertificate.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_steal_authentication_certificates_export_certificate.test.yml b/tests/endpoint/windows_steal_authentication_certificates_export_certificate.test.yml
new file mode 100644
index 0000000000..c4f9b47a2f
--- /dev/null
+++ b/tests/endpoint/windows_steal_authentication_certificates_export_certificate.test.yml
@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates Export Certificate Unit Test
+tests:
+- name: Windows Steal Authentication Certificates Export Certificate
+  file: endpoint/windows_steal_authentication_certificates_export_certificate.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: export_certificate_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.test.yml b/tests/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.test.yml
new file mode 100644
index 0000000000..1bcdc65790
--- /dev/null
+++ b/tests/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.test.yml
@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates Export PfxCertificate Unit Test
+tests:
+- name: Windows Steal Authentication Certificates Export PfxCertificate
+  file: endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: export_pfxcertificate_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_pfxcertificate_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 710ed1144935bbaefae9f3d763e4ebff3ee9a361 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 3 Feb 2023 09:07:10 -0700
Subject: [PATCH 04/15] fixy

---
 tests/endpoint/windows_powershell_export_certificate.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/windows_powershell_export_certificate.test.yml b/tests/endpoint/windows_powershell_export_certificate.test.yml
index fa0eef21ec..5e9573be3c 100644
--- a/tests/endpoint/windows_powershell_export_certificate.test.yml
+++ b/tests/endpoint/windows_powershell_export_certificate.test.yml
@@ -1,7 +1,7 @@
 name: Windows PowerShell Export PfxCertificate Unit Test
 tests:
 - name: Windows PowerShell Export PfxCertificate
-  file: endpoint/windows_powershell_export_pfxcertificate.yml
+  file: endpoint/windows_powershell_export_certificate.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now

From 7ab04b6d7297a1702e6c490bbc28f5bf24546d0b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 3 Feb 2023 09:49:36 -0700
Subject: [PATCH 05/15] PubPath

---
 ...eduled_task_created_within_public_path.yml | 29 ++++++++++++-------
 ...d_task_created_within_public_path.test.yml |  4 +--
 2 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index ae08ecbce2..ebc5612ddb 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -1,8 +1,8 @@
 name: WinEvent Scheduled Task Created Within Public Path
 id: 5d9c6eee-988c-11eb-8253-acde48001122
-version: 1
-date: '2021-04-08'
-author: Michael Haag, Splunk
+version: 2
+date: '2023-01-26'
+author: Steven Dick, Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled
@@ -24,11 +24,14 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s
   TaskService. Review the job created and the Command to be executed. Capture any
   artifacts on disk and review. Identify any parallel processes within the same timeframe
   to identify source.'
-search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
-  ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*",
-  "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) as lastTime by
-  dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`'
+search: '`wineventlog_security` EventCode=4698 
+  | xmlkv TaskContent 
+  | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") 
+  | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by dest, TaskName, Command, Enabled, Hidden,Caller_User_Name
+  | eval command=TaskContent, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `winevent_scheduled_task_created_within_public_path_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
   required.
@@ -58,7 +61,7 @@ tags:
   - Stage:Persistence
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/4698_windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
@@ -83,9 +86,13 @@ tags:
   required_fields:
   - _time
   - dest
-  - Task_Name
-  - Description
+  - TaskName
   - Command
+  - Enabled
+  - Hidden
+  - Caller_User_Name
+  - Arguments
+  - TaskContent
   risk_score: 70
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml
index fd0bca9456..318a5d9624 100644
--- a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml
+++ b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log
+  - file_name: 4698_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/4698_windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
     update_timestamp: true

From ccc97c6dca9a3dd51e3cde995f4ac389ad46088e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 3 Feb 2023 09:55:08 -0700
Subject: [PATCH 06/15] MOAR Tasks

---
 ..._scheduled_task_created_to_spawn_shell.yml | 25 +++++++++++--------
 ...duled_task_created_to_spawn_shell.test.yml |  4 +--
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
index 82fc6cf309..26a3003fe3 100644
--- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
@@ -1,7 +1,7 @@
 name: WinEvent Scheduled Task Created to Spawn Shell
 id: 203ef0ea-9bd8-11eb-8201-acde48001122
-version: 1
-date: '2021-04-12'
+version: 2
+date: '2023-02-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -24,11 +24,13 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s
   Review the job created and the Command to be executed. Capture any artifacts on
   disk and review. Identify any parallel processes within the same timeframe to identify
   source.'
-search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
-  ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*",
-  "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") | stats count
-  min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author,
-  Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`wineventlog_security` EventCode=4698 
+  | xmlkv TaskContent 
+  | search Command IN ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*", "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") 
+  | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by dest, TaskName, Command, Enabled, Hidden,Caller_User_Name
+  | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
   | `winevent_scheduled_task_created_to_spawn_shell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
@@ -54,7 +56,7 @@ tags:
   - Stage:Persistence
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/4698_shell_windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
@@ -79,9 +81,12 @@ tags:
   required_fields:
   - _time
   - dest
-  - Task_Name
-  - Description
+  - Author
+  - TaskName
   - Command
+  - Enabled
+  - Hidden
+  - Caller_User_Name
   risk_score: 70
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml
index d58142a54b..6bfdb7adcd 100644
--- a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml
+++ b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log
+  - file_name: 4698_shell_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/4698_shell_windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
     update_timestamp: true

From 1d42f499c6b250690eea63bd80c47c2e195e7277 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 3 Feb 2023 13:46:59 -0700
Subject: [PATCH 07/15] Update
 winevent_scheduled_task_created_within_public_path.yml

---
 .../winevent_scheduled_task_created_within_public_path.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index ebc5612ddb..49c1b4ded3 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -28,7 +28,7 @@ search: '`wineventlog_security` EventCode=4698
   | xmlkv TaskContent 
   | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") 
   | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by dest, TaskName, Command, Enabled, Hidden,Caller_User_Name
-  | eval command=TaskContent, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name
+  | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `winevent_scheduled_task_created_within_public_path_filter`'

From b4796ccc27095a7847caeb1808761c3b8f58a6ae Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 3 Feb 2023 14:51:28 -0700
Subject: [PATCH 08/15] Driver Inventory

---
 .../endpoint/windows_driver_inventory.yml     | 52 +++++++++++++++++++
 macros/driverinventory.yml                    |  4 ++
 .../windows_driver_inventory.test.yml         | 13 +++++
 3 files changed, 69 insertions(+)
 create mode 100644 detections/endpoint/windows_driver_inventory.yml
 create mode 100644 macros/driverinventory.yml
 create mode 100644 tests/endpoint/windows_driver_inventory.test.yml

diff --git a/detections/endpoint/windows_driver_inventory.yml b/detections/endpoint/windows_driver_inventory.yml
new file mode 100644
index 0000000000..31319902be
--- /dev/null
+++ b/detections/endpoint/windows_driver_inventory.yml
@@ -0,0 +1,52 @@
+name: Windows Driver Inventory
+id: f87aa96b-369b-4a3e-9021-1bbacbfcb8fb
+version: 1
+date: '2023-02-03'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: The following hunting / inventory query assists defenders in identifying Drivers being loaded across the fleet. This query relies upon a PowerShell script input to be deployed to critical systems and beyond. If capturing all via the input, this will provide retrospection into drivers persisting. 
+  Note, that this is not perfect across a large fleet. Modify the query as you need to view the data differently. 
+search: '`driverinventory` | stats values(Path) min(_time) as firstTime max(_time) as lastTime count by host DriverType | rename host as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_driver_inventory_filter`'
+how_to_implement: To capture the drivers by host, utilize the referenced Gist to create the inputs, props and transforms. Otherwise, this hunt query will not work. 
+known_false_positives: Filter and modify the analytic as you'd like. Filter based on path. Remove the system32\drivers and look for non-standard paths.
+references:
+  - https://gist.github.com/MHaggis/3e4dc85c69b3f7a4595a06c8a692f244
+tags:
+  analytic_story:
+  - Windows Drivers
+  asset_type: endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 10
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/driver_inventory.log
+  impact: 50
+  kill_chain_phases:
+  - Installation
+  message: Drivers have been identified on $dest$.
+  mitre_attack_id:
+  - T1068
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Path
+  - host 
+  - DriverType
+  risk_score: 5
+  security_domain: endpoint
\ No newline at end of file
diff --git a/macros/driverinventory.yml b/macros/driverinventory.yml
new file mode 100644
index 0000000000..ff6620cc20
--- /dev/null
+++ b/macros/driverinventory.yml
@@ -0,0 +1,4 @@
+definition: sourcetype=PwSh:DriverInventory
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: driverinventory
\ No newline at end of file
diff --git a/tests/endpoint/windows_driver_inventory.test.yml b/tests/endpoint/windows_driver_inventory.test.yml
new file mode 100644
index 0000000000..0565686f8e
--- /dev/null
+++ b/tests/endpoint/windows_driver_inventory.test.yml
@@ -0,0 +1,13 @@
+name: Windows Driver Inventory Unit Test
+tests:
+- name: Windows Driver Inventory
+  file: endpoint/windows_driver_inventory.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: driver_inventory.log
+    data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/driver_inventory.log
+    source: powershell://DriverInventory
+    sourcetype: PwSh:DriverInventory
+    update_timestamp: true

From 1f57edfdd4bc3f5dc30110edb9b292d3d5807438 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 3 Feb 2023 14:59:37 -0700
Subject: [PATCH 09/15] Update windows_driver_inventory.test.yml

---
 tests/endpoint/windows_driver_inventory.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/windows_driver_inventory.test.yml b/tests/endpoint/windows_driver_inventory.test.yml
index 0565686f8e..1cbd704682 100644
--- a/tests/endpoint/windows_driver_inventory.test.yml
+++ b/tests/endpoint/windows_driver_inventory.test.yml
@@ -8,6 +8,6 @@ tests:
   attack_data:
   - file_name: driver_inventory.log
     data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/driver_inventory.log
-    source: powershell://DriverInventory
+    source: PwSh:DriverInventory
     sourcetype: PwSh:DriverInventory
     update_timestamp: true

From 70c93f798f2b0bea9a6087daa07364ceade10065 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 3 Feb 2023 15:05:26 -0700
Subject: [PATCH 10/15] Update windows_driver_inventory.test.yml

---
 tests/endpoint/windows_driver_inventory.test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_driver_inventory.test.yml b/tests/endpoint/windows_driver_inventory.test.yml
index 1cbd704682..a1ea16d4a9 100644
--- a/tests/endpoint/windows_driver_inventory.test.yml
+++ b/tests/endpoint/windows_driver_inventory.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: now
   attack_data:
   - file_name: driver_inventory.log
-    data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/driver_inventory.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/driver_inventory.log
     source: PwSh:DriverInventory
     sourcetype: PwSh:DriverInventory
-    update_timestamp: true
+    update_timestamp: true
\ No newline at end of file

From a1f8c088311a3848fb1812c9a7c3c5c795b4a802 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 6 Feb 2023 07:03:37 -0700
Subject: [PATCH 11/15] Certs! Certs! CERTS!

---
 ...cation_certificates_certificate_issued.yml | 54 +++++++++++++++++++
 ...ation_certificates_certificate_request.yml | 53 ++++++++++++++++++
 ...n_certificates_certificate_issued.test.yml | 13 +++++
 ..._certificates_certificate_request.test.yml | 13 +++++
 4 files changed, 133 insertions(+)
 create mode 100644 detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml
 create mode 100644 detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml
 create mode 100644 tests/endpoint/windows_steal_authentication_certificates_certificate_issued.test.yml
 create mode 100644 tests/endpoint/windows_steal_authentication_certificates_certificate_request.test.yml

diff --git a/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml b/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml
new file mode 100644
index 0000000000..1dc1ba89d8
--- /dev/null
+++ b/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml
@@ -0,0 +1,54 @@
+name: Windows Steal Authentication Certificates Certificate Issued
+id: 9b1a5385-0c31-4c39-9753-dc26b8ce64c2
+version: 1
+date: '2023-02-06'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description:  The following analytic identifies when a new certificate is issued against the Certificate Services - AD CS. By its very nature this is not malicious, but should be tracked and correlated with other events related to certificates being issued.
+  When the CA issues the certificate, it creates EID 4887 'Certificate Services approved a certificate request and issued a certificate".
+  The event supplies the requester user context, the DNS hostname of the machine they requested the certificate from, and the time they requested the certificate. The attributes fields in these event commonly has values for CDC, RMD, and CCM which correspond to Client DC, Request Machine DNS name, and Cert Client Machine, respectively.
+search: '`wineventlog_security`  EventCode=4887 | stats count min(_time) as firstTime max(_time) as lastTime by dest, name, Requester, action, Attributes, Subject | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_steal_authentication_certificates_certificate_issued_filter`'
+how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference.
+known_false_positives: False positives will be generated based on normal certificates issued. Leave enabled to generate Risk, as this is meant to be an anomaly analytic.
+references:
+- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4887_windows-security.log
+  impact: 10
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A certificate was issued to $dest$.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - name
+  - Requester
+  - action
+  - Attributes
+  risk_score: 8
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml b/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml
new file mode 100644
index 0000000000..71ba68bdb7
--- /dev/null
+++ b/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml
@@ -0,0 +1,53 @@
+name: Windows Steal Authentication Certificates Certificate Request
+id: 747d7800-2eaa-422d-b994-04d8bb9e06d0
+version: 1
+date: '2023-02-06'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies when a new certificate is requested against the Certificate Services - AD CS. By its very nature this is not malicious, but should be tracked and correlated with other events related to certificate requests.
+  When an account requests a certificate, the CA generates event ID (EID) 4886 "Certificate Services received a certificate request".
+search: '`wineventlog_security` EventCode=4886 | stats count min(_time) as firstTime max(_time) as lastTime by dest, name, Requester, action, Attributes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_certificate_request_filter`'
+how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference.
+known_false_positives: False positives will be generated based on normal certificate requests. Leave enabled to generate Risk, as this is meant to be an anomaly analytic.
+references:
+- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4886_windows-security.log
+  impact: 10
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A certificate was requested by $dest$.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - name
+  - Requester
+  - action
+  - Attributes
+  risk_score: 8
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/windows_steal_authentication_certificates_certificate_issued.test.yml b/tests/endpoint/windows_steal_authentication_certificates_certificate_issued.test.yml
new file mode 100644
index 0000000000..a3b7093638
--- /dev/null
+++ b/tests/endpoint/windows_steal_authentication_certificates_certificate_issued.test.yml
@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates Certificate Issued Unit Test
+tests:
+- name: Windows Steal Authentication Certificates Certificate Issued
+  file: endpoint/windows_steal_authentication_certificates_certificate_issued.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4887_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4887_windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_steal_authentication_certificates_certificate_request.test.yml b/tests/endpoint/windows_steal_authentication_certificates_certificate_request.test.yml
new file mode 100644
index 0000000000..9708d5a750
--- /dev/null
+++ b/tests/endpoint/windows_steal_authentication_certificates_certificate_request.test.yml
@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates Certificate Request Unit Test
+tests:
+- name: Windows Steal Authentication Certificates Certificate Request
+  file: endpoint/windows_steal_authentication_certificates_certificate_request.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4886_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4886_windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

From 94153c0a5578b1f2e65220fd8c0f3ca1bdb9c828 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 6 Feb 2023 09:48:55 -0700
Subject: [PATCH 12/15] Backup Time

---
 ...ntication_certificates_certutil_backup.yml | 78 +++++++++++++++++++
 ..._authentication_certificates_cs_backup.yml | 52 +++++++++++++
 ...tion_certificates_certutil_backup.test.yml | 13 ++++
 ...entication_certificates_cs_backup.test.yml | 13 ++++
 4 files changed, 156 insertions(+)
 create mode 100644 detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml
 create mode 100644 detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml
 create mode 100644 tests/endpoint/windows_steal_authentication_certificates_certutil_backup.test.yml
 create mode 100644 tests/endpoint/windows_steal_authentication_certificates_cs_backup.test.yml

diff --git a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml
new file mode 100644
index 0000000000..eef4ee8265
--- /dev/null
+++ b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml
@@ -0,0 +1,78 @@
+name: Windows Steal Authentication Certificates CertUtil Backup
+id: bac85b56-0b65-4ce5-aad5-d94880df0967
+version: 1
+date: '2023-02-06'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic is focused on CertUtil.exe performing a backup of the Certificate Store. 
+  Typically, administrators may perform this task to migrate or perform backups of the store, however it may be found uncommon in most organizations.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil`
+  Processes.process IN ("*-backupdb *", "*-backup *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_certutil_backup_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be generated based on normal certificate store backups. Leave enabled to generate Risk, as this is meant to be an anomaly analytic. If CS backups are not normal, enable as TTP. 
+references:
+- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/backupdb_certutil_windows-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to backup the Certificate Store.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 40
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml b/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml
new file mode 100644
index 0000000000..579f7f7f3f
--- /dev/null
+++ b/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml
@@ -0,0 +1,52 @@
+name: Windows Steal Authentication Certificates CS Backup
+id: a2f4cc7f-6503-4078-b206-f83a29f408a7
+version: 1
+date: '2023-02-06'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies when the Active Directory Certificate Services store is backed up utilizing Event ID 4876. This event triggers whenever the backup occurs in the UI of CertSrv.msc or via CertUtil.exe -BackupDB occurs. 
+search: '`wineventlog_security` EventCode=4876| stats count min(_time) as firstTime max(_time) as lastTime by dest, name, action, Caller_Domain ,Caller_User_Name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_cs_backup_filter`'
+how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 128 of first reference.
+known_false_positives: False positives will be generated based on normal certificate store backups. Leave enabled to generate Risk, as this is meant to be an anomaly analytic. If CS backups are not normal, enable as TTP. 
+references:
+- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
+tags:
+  analytic_story:
+  - Windows Certificate Services
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4876_windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: The Active Directory Certiciate Services was backed up on $dest$.
+  mitre_attack_id:
+  - T1649
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - name
+  - action
+  - Caller_Domain
+  - Caller_User_Name
+  risk_score: 40
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_steal_authentication_certificates_certutil_backup.test.yml b/tests/endpoint/windows_steal_authentication_certificates_certutil_backup.test.yml
new file mode 100644
index 0000000000..813ccab337
--- /dev/null
+++ b/tests/endpoint/windows_steal_authentication_certificates_certutil_backup.test.yml
@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates CertUtil Backup Unit Test
+tests:
+- name: Windows Steal Authentication Certificates CertUtil Backup
+  file: endpoint/windows_steal_authentication_certificates_certutil_backup.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: backupdb_certutil_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/backupdb_certutil_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_steal_authentication_certificates_cs_backup.test.yml b/tests/endpoint/windows_steal_authentication_certificates_cs_backup.test.yml
new file mode 100644
index 0000000000..802c7cef9b
--- /dev/null
+++ b/tests/endpoint/windows_steal_authentication_certificates_cs_backup.test.yml
@@ -0,0 +1,13 @@
+name: Windows Steal Authentication Certificates CS Backup Unit Test
+tests:
+- name: Windows Steal Authentication Certificates CS Backup
+  file: endpoint/windows_steal_authentication_certificates_cs_backup.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4876_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4876_windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

From c275a89ab14caad8f3264eed23268e18d3792fd6 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 6 Feb 2023 11:35:04 -0700
Subject: [PATCH 13/15] experimental

---
 .../{ => experimental}/endpoint/windows_driver_inventory.yml   | 3 ++-
 .../endpoint/windows_driver_inventory.test.yml                 | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)
 rename detections/{ => experimental}/endpoint/windows_driver_inventory.yml (94%)
 rename tests/{ => experimental}/endpoint/windows_driver_inventory.test.yml (88%)

diff --git a/detections/endpoint/windows_driver_inventory.yml b/detections/experimental/endpoint/windows_driver_inventory.yml
similarity index 94%
rename from detections/endpoint/windows_driver_inventory.yml
rename to detections/experimental/endpoint/windows_driver_inventory.yml
index 31319902be..5281a3f5ea 100644
--- a/detections/endpoint/windows_driver_inventory.yml
+++ b/detections/experimental/endpoint/windows_driver_inventory.yml
@@ -49,4 +49,5 @@ tags:
   - host 
   - DriverType
   risk_score: 5
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  developer_comments: Needs custom Props/Transforms. Details are in How to Implement.
\ No newline at end of file
diff --git a/tests/endpoint/windows_driver_inventory.test.yml b/tests/experimental/endpoint/windows_driver_inventory.test.yml
similarity index 88%
rename from tests/endpoint/windows_driver_inventory.test.yml
rename to tests/experimental/endpoint/windows_driver_inventory.test.yml
index a1ea16d4a9..71bd14b4bd 100644
--- a/tests/endpoint/windows_driver_inventory.test.yml
+++ b/tests/experimental/endpoint/windows_driver_inventory.test.yml
@@ -1,7 +1,7 @@
 name: Windows Driver Inventory Unit Test
 tests:
 - name: Windows Driver Inventory
-  file: endpoint/windows_driver_inventory.yml
+  file: experimental/endpoint/windows_driver_inventory.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now

From 3526c9df4ed2a54762ffa43dd1b025ba0d30d1dd Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 6 Feb 2023 14:46:07 -0800
Subject: [PATCH 14/15] revert errrors

---
 ..._scheduled_task_created_to_spawn_shell.yml | 31 ++++++----------
 ...eduled_task_created_within_public_path.yml | 35 +++++++------------
 2 files changed, 23 insertions(+), 43 deletions(-)

diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
index 26a3003fe3..a08b59bc46 100644
--- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
@@ -1,7 +1,7 @@
 name: WinEvent Scheduled Task Created to Spawn Shell
 id: 203ef0ea-9bd8-11eb-8201-acde48001122
-version: 2
-date: '2023-02-03'
+version: 1
+date: '2021-04-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -9,28 +9,22 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with a command to be executed with a native Windows
   shell (PowerShell, Cmd, Wscript, Cscript).\
-
   The search will return the first time and last time the task was registered, as
   well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
   it is `Hidden` or not.\
-
   schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\
-
   The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`.
   If found loaded by another process, it is possible a scheduled task is being registered
   within that process context in memory.\
-
   Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService?
   Review the job created and the Command to be executed. Capture any artifacts on
   disk and review. Identify any parallel processes within the same timeframe to identify
   source.'
-search: '`wineventlog_security` EventCode=4698 
-  | xmlkv TaskContent 
-  | search Command IN ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*", "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") 
-  | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by dest, TaskName, Command, Enabled, Hidden,Caller_User_Name
-  | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
+  ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*",
+  "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author,
+  Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `winevent_scheduled_task_created_to_spawn_shell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
@@ -56,7 +50,7 @@ tags:
   - Stage:Persistence
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/4698_shell_windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
@@ -81,12 +75,9 @@ tags:
   required_fields:
   - _time
   - dest
-  - Author
-  - TaskName
+  - Task_Name
+  - Description
   - Command
-  - Enabled
-  - Hidden
-  - Caller_User_Name
   risk_score: 70
   security_domain: endpoint
-  asset_type: Endpoint
+  asset_type: Endpoint
\ No newline at end of file
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index 49c1b4ded3..2cf55b3181 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -1,37 +1,30 @@
 name: WinEvent Scheduled Task Created Within Public Path
 id: 5d9c6eee-988c-11eb-8253-acde48001122
-version: 2
-date: '2023-01-26'
-author: Steven Dick, Michael Haag, Splunk
+version: 1
+date: '2021-04-08'
+author: Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with a command to be executed from a user writeable
   file path.\
-
   The search will return the first time and last time the task was registered, as
   well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
   it is `Hidden` or not.\
-
   schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\
-
   The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`.
   If found loaded by another process, it is possible a scheduled task is being registered
   within that process context in memory.\
-
   Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via
   TaskService. Review the job created and the Command to be executed. Capture any
   artifacts on disk and review. Identify any parallel processes within the same timeframe
   to identify source.'
-search: '`wineventlog_security` EventCode=4698 
-  | xmlkv TaskContent 
-  | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") 
-  | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by dest, TaskName, Command, Enabled, Hidden,Caller_User_Name
-  | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `winevent_scheduled_task_created_within_public_path_filter`'
+search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
+  ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*",
+  "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) as lastTime by
+  dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
   required.
@@ -61,7 +54,7 @@ tags:
   - Stage:Persistence
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/4698_windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
@@ -86,13 +79,9 @@ tags:
   required_fields:
   - _time
   - dest
-  - TaskName
+  - Task_Name
+  - Description
   - Command
-  - Enabled
-  - Hidden
-  - Caller_User_Name
-  - Arguments
-  - TaskContent
   risk_score: 70
   security_domain: endpoint
-  asset_type: Endpoint
+  asset_type: Endpoint
\ No newline at end of file

From e2189bd0e125ac50ae2b6d844c5d82cfea9e55fd Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 6 Feb 2023 16:39:38 -0800
Subject: [PATCH 15/15] chage test files

---
 .../winevent_scheduled_task_created_to_spawn_shell.yml        | 2 +-
 .../winevent_scheduled_task_created_to_spawn_shell.test.yml   | 4 ++--
 ...inevent_scheduled_task_created_within_public_path.test.yml | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
index a08b59bc46..9a0047e23e 100644
--- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
@@ -1,6 +1,6 @@
 name: WinEvent Scheduled Task Created to Spawn Shell
 id: 203ef0ea-9bd8-11eb-8201-acde48001122
-version: 1
+version: 2
 date: '2021-04-12'
 author: Michael Haag, Splunk
 type: TTP
diff --git a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml
index 6bfdb7adcd..d58142a54b 100644
--- a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml
+++ b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: 4698_shell_windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/4698_shell_windows-security.log
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
     update_timestamp: true
diff --git a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml
index 318a5d9624..8798c49336 100644
--- a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml
+++ b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: 4698_windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/4698_windows-security.log
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
     update_timestamp: true