Merge branch 'xmrig' of https://github.com/splunk/security_content into xmrig

detections/endpoint/disabling_net_user_account.yml

@@ -6,21 +6,21 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious commandline that disable a net user account.
-  This technique may used by the adversaries or attacker to interrupt availability of such users to do their malicious act.
+description: This search is to detect a suspicious commandline that disable a net
+  user account. This technique may used by the adversaries or attacker to interrupt
+  availability of such users to do their malicious act.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND Processes.process="*user*" AND Processes.process="*/active:no*"
-  by  Processes.process_name Processes.dest Processes.user Processes.parent_process_name  
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `disabling_net_user_account_filter`'
+  where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND
+  Processes.process="*user*" AND Processes.process="*/active:no*" by  Processes.process_name
+  Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_net_user_account_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be used.
+  Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
+  used.
 known_false_positives: unknown
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -40,7 +40,10 @@ tags:
   - Processes.process_name
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name 
+  - Processes.parent_process_name
   - Processes.process_id
   - Processes.parent_process
-  security_domain: endpoint
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log