Branch was auto-updated.

detections/cloud/o365_excessive_authentication_failures_alert.yml

@@ -1,17 +1,19 @@
 name: O365 Excessive Authentication Failures Alert
 id: d441364c-349c-453b-b55f-12eccab67cf9
-version: 1
-date: '2020-12-16'
+version: 2
+date: '2022-02-18'
 author: Rod Soto, Splunk
 type: Anomaly
 datamodel: []
 description: This search detects when an excessive number of authentication failures
   occur this search also includes attempts against MFA prompt codes
-search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=*
-  status=Failed | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod)
-  AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status
-  values(src_ip) AS src_ip by user | where count > 10 |`security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter`'
+search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
+  | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod 
+  values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
+  | where count > 10 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `o365_excessive_authentication_failures_alert_filter`'
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
   works with o365:management:activity
 known_false_positives: The threshold for alert is above 10 attempts and this should

detections/endpoint/detect_regasm_with_network_connection.yml

@@ -1,7 +1,7 @@
 name: Detect Regasm with Network Connection
 id: 07921114-6db4-4e2e-ae58-3ea8a52ae93f
-version: 1
-date: '2021-02-16'
+version: 2
+date: '2022-02-18'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -15,10 +15,12 @@ description: The following analytic identifies regasm.exe with a network connect
   and review accordingly. Review the reputation of the remote IP or domain and block
   as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
-  process_name=regasm.exe | rename Computer as dest | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip |
-  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`'
+search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regasm.exe 
+  | rename Computer as dest 
+  | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `detect_regasm_with_network_connection_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -59,7 +61,7 @@ tags:
     type: User
     role:
     - Victim
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim
@@ -77,7 +79,7 @@ tags:
   - dest_ip
   - process_name
   - Computer
-  - User
+  - user
   - src_ip
   - dest_host
   - dest_ip

detections/endpoint/detect_regsvcs_with_network_connection.yml

@@ -1,7 +1,7 @@
 name: Detect Regsvcs with Network Connection
 id: e3e7a1c0-f2b9-445c-8493-f30a63522d1a
-version: 1
-date: '2021-02-16'
+version: 2
+date: '2022-02-18'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -15,10 +15,12 @@ description: The following analytic identifies Regsvcs.exe with a network connec
   and review accordingly. Review the reputation of the remote IP or domain and block
   as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
-  process_name=regsvcs.exe | rename Computer as dest | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip |
-  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`'
+search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe 
+  | rename Computer as dest 
+  | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `detect_regsvcs_with_network_connection_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -59,7 +61,7 @@ tags:
     type: User
     role:
     - Victim
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim
@@ -77,7 +79,7 @@ tags:
   - dest_ip
   - process_name
   - Computer
-  - User
+  - user
   - src_ip
   - dest_host
   risk_score: 80

detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml

@@ -1,7 +1,7 @@
 name: Interactive Session on Remote Endpoint with PowerShell
 id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af
-version: 1
-date: '2021-11-18'
+version: 2
+date: '2022-02-18'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,10 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams
   and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement
   and remote code execution.
-search: powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `interactive_session_on_remote_endpoint_with_powershell_filter`
+search: '`powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*") 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
+  | `security_content_ctime(firstTime)` 
+  | `interactive_session_on_remote_endpoint_with_powershell_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
   can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.

detections/endpoint/net_profiler_uac_bypass.yml

@@ -1,7 +1,7 @@
 name: NET Profiler UAC bypass
 id: 0252ca80-e30d-11eb-8aa3-acde48001122
-version: 1
-date: '2021-07-12'
+version: 2
+date: '2022-02-18'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -12,11 +12,14 @@ description: This search is to detect modification of registry to bypass UAC win
   the registry key and values in the detection area. It may happened that windows
   update some dll related to mmc.exe and add dll path in this registry. In this case
   filtering is needed.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH"
-  Registry.registry_value_name = "*.dll" by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
+  from datamodel=Endpoint.Registry where 
+  Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_data = "*.dll" 
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `net_profiler_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/powershell_remove_windows_defender_directory.yml

@@ -1,7 +1,7 @@
 name: Powershell Remove Windows Defender Directory
 id: adf47620-79fa-11ec-b248-acde48001122
-version: 1
-date: '2022-01-20'
+version: 2
+date: '2022-01-18'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,10 +11,11 @@ description: This analytic will identify a suspicious PowerShell command used to
   campaign where it used Nirsofts advancedrun.exe to gain administrative privileges
   to then execute a PowerShell command to delete the Windows Defender folder. This
   is a good indicator the offending process is trying corrupt a Windows Defender installation.
-search: '`powershell` EventCode=4104 Message = "* rmdir *" AND Message = "*\\Microsoft\\Windows
-  Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
-  Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `powershell_remove_windows_defender_directory_filter`'
+search: '`powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows Defender*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `powershell_remove_windows_defender_directory_filter` '
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.

detections/endpoint/process_deleting_its_process_file_path.yml

@@ -1,7 +1,7 @@
 name: Process Deleting Its Process File Path
 id: f7eda4bc-871c-11eb-b110-acde48001122
-version: 1
-date: '2021-03-17'
+version: 2
+date: '2022-02-18'
 author: Teoderick Contreras
 type: TTP
 datamodel:
@@ -11,11 +11,13 @@ description: This detection is to identify a suspicious process that tries to de
   evasion once a certain condition of malware is satisfied or not. Clop ransomware
   use this technique where it will try to delete its process file path using a .bat
   command if the keyboard layout is not the layout it tries to infect.
-search: '`sysmon` EventCode=1 cmdline = "* /c *" cmdline = "* del*" Image = "*\\cmd.exe"
-  |eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") |
-  stats min(_time) as firstTime max(_time) as lastTime count by Computer user ParentImage
-  ParentCommandLine Image cmdline EventCode ProcessID result | where result = "Found"
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_deleting_its_process_file_path_filter`'
+search: '`sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image = "*\\cmd.exe" 
+  | eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") 
+  | stats min(_time) as firstTime max(_time) as lastTime count by Computer user ParentImage ParentCommandLine Image CommandLine EventCode ProcessID result 
+  | where result = "Found" 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `process_deleting_its_process_file_path_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
@@ -34,8 +36,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - source:endpoint
-  - stage: Credential Access
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log
   impact: 60
@@ -51,7 +53,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: user
+    type: User
     role:
     - Victim
   product:

detections/endpoint/rundll32_dnsquery.yml

@@ -1,7 +1,7 @@
 name: Rundll32 DNSQuery
 id: f1483f5e-ee29-11eb-9d23-acde48001122
-version: 1
-date: '2021-07-26'
+version: 2
+date: '2022-02-18'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,9 +11,10 @@ description: This search is to detect a suspicious rundll32.exe process having a
   malware where the rundll32 that execute its payload will contact amazon.com to check
   internet connect and to communicate to its C&C server to download config and other
   file component.
-search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time)
-  as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId direction
-  Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`sysmon` EventCode=22 process_name="rundll32.exe" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId  Computer 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
   | `rundll32_dnsquery_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name and eventcode = 22 dnsquery executions from your endpoints.
@@ -59,7 +60,6 @@ tags:
   - QueryName
   - QueryStatus
   - ProcessId
-  - direction
   - Computer
   risk_score: 56
   security_domain: endpoint

detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

@@ -1,18 +1,20 @@
 name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
 id: c2590137-0b08-4985-9ec5-6ae23d92f63d
-version: 6
-date: '2020-11-06'
+version: 7
+date: '2022-02-18'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: Monitor for changes of the ExecutionPolicy in the registry to the values
   "unrestricted" or "bypass," which allows the execution of malicious scripts.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell*
-  Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted
-  OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from 
+  datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* 
+  Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted OR Registry.registry_value_data=Bypass) 
+  by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
   | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Registry node. You must also be

tests/endpoint/process_execution_via_wmi.test.yml

@@ -2,7 +2,7 @@ name: Process execution via wmi Unit Test
 tests:
 - name: Process execution via wmi
   file: endpoint/process_execution_via_wmi.yml
-  pass_condition: '| stats count | where count = 1'
+  pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data: