From 7648c76c0bb839964a52ac6f77ea5b37c8efb432 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 14 Feb 2022 16:57:33 -0800
Subject: [PATCH 1/5] A handful of easy detection test fixes to get the tests
 to detections to work with the newest application baseline.

---
 .../cloud/aws_excessive_security_scanning.yml      | 12 +++++++-----
 .../detect_regsvcs_with_network_connection.yml     | 11 +++++++----
 ..._session_on_remote_endpoint_with_powershell.yml | 10 +++++++---
 detections/endpoint/net_profiler_uac_bypass.yml    | 14 +++++++++-----
 .../process_deleting_its_process_file_path.yml     | 13 ++++++++-----
 detections/endpoint/rundll32_dnsquery.yml          |  8 +++++---
 ..._execution_policy_to_unrestricted_or_bypass.yml | 13 ++++++++-----
 tests/endpoint/process_execution_via_wmi.test.yml  |  2 +-
 8 files changed, 52 insertions(+), 31 deletions(-)

diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml
index 690360f6f2..97829915ef 100644
--- a/detections/cloud/aws_excessive_security_scanning.yml
+++ b/detections/cloud/aws_excessive_security_scanning.yml
@@ -8,11 +8,13 @@ datamodel: []
 description: This search looks for AWS CloudTrail events and analyse the amount of
   eventNames which starts with Describe by a single user. This indicates that this
   user scans the configuration of your AWS cloud environment.
-search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  |
-  stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime
-  values(eventName) as eventName values(src) as src values(userAgent) as userAgent
-  by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`'
+search: '
+  `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
+  | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
+  | where count > 10 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `o365_excessive_authentication_failures_alert_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives.
diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml
index 7329369714..8bc454037e 100644
--- a/detections/endpoint/detect_regsvcs_with_network_connection.yml
+++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml
@@ -15,10 +15,13 @@ description: The following analytic identifies Regsvcs.exe with a network connec
   and review accordingly. Review the reputation of the remote IP or domain and block
   as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
-  process_name=regsvcs.exe | rename Computer as dest | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip |
-  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`'
+search: '
+  `sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe 
+  | rename Computer as dest 
+  | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_ip 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `detect_regsvcs_with_network_connection_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
index eb2c580a34..1e4ead1eb5 100644
--- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
+++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
@@ -10,9 +10,13 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams
   and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement
   and remote code execution.
-search: powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `interactive_session_on_remote_endpoint_with_powershell_filter`
+search: '
+  `powershell` EventCode=4104 (Message=""*Enter-PSSession*"" AND Message=""*-ComputerName*"") 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
+  | `security_content_ctime(firstTime)` 
+  | `interactive_session_on_remote_endpoint_with_powershell_filter` 
+  | stats count 
+  | where count > 0'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
   can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml
index 1bbe6e2656..895e3caf1d 100644
--- a/detections/endpoint/net_profiler_uac_bypass.yml
+++ b/detections/endpoint/net_profiler_uac_bypass.yml
@@ -12,11 +12,15 @@ description: This search is to detect modification of registry to bypass UAC win
   the registry key and values in the detection area. It may happened that windows
   update some dll related to mmc.exe and add dll path in this registry. In this case
   filtering is needed.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH"
-  Registry.registry_value_name = "*.dll" by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`'
+search: '
+  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
+  from datamodel=Endpoint.Registry where 
+  Registry.registry_path= ""*\\Environment\\COR_PROFILER_PATH"" Registry.registry_value_data = ""*.dll"" 
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `net_profiler_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml
index 92a9f3a6d7..ca5987bc42 100644
--- a/detections/endpoint/process_deleting_its_process_file_path.yml
+++ b/detections/endpoint/process_deleting_its_process_file_path.yml
@@ -11,11 +11,14 @@ description: This detection is to identify a suspicious process that tries to de
   evasion once a certain condition of malware is satisfied or not. Clop ransomware
   use this technique where it will try to delete its process file path using a .bat
   command if the keyboard layout is not the layout it tries to infect.
-search: '`sysmon` EventCode=1 cmdline = "* /c *" cmdline = "* del*" Image = "*\\cmd.exe"
-  |eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") |
-  stats min(_time) as firstTime max(_time) as lastTime count by Computer user ParentImage
-  ParentCommandLine Image cmdline EventCode ProcessID result | where result = "Found"
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_deleting_its_process_file_path_filter`'
+search: '
+  `sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image = "*\\cmd.exe" 
+  | eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") 
+  | stats min(_time) as firstTime max(_time) as lastTime count by Computer user ParentImage ParentCommandLine Image CommandLine EventCode ProcessID result 
+  | where result = "Found" 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `process_deleting_its_process_file_path_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml
index d542ef031f..2311ca8aca 100644
--- a/detections/endpoint/rundll32_dnsquery.yml
+++ b/detections/endpoint/rundll32_dnsquery.yml
@@ -11,9 +11,11 @@ description: This search is to detect a suspicious rundll32.exe process having a
   malware where the rundll32 that execute its payload will contact amazon.com to check
   internet connect and to communicate to its C&C server to download config and other
   file component.
-search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time)
-  as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId direction
-  Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '
+  `sysmon` EventCode=22 process_name="rundll32.exe" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId  Computer 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
   | `rundll32_dnsquery_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name and eventcode = 22 dnsquery executions from your endpoints.
diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
index 61f741ddab..4fbb59fa71 100644
--- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
@@ -8,11 +8,14 @@ datamodel:
 - Endpoint
 description: Monitor for changes of the ExecutionPolicy in the registry to the values
   "unrestricted" or "bypass," which allows the execution of malicious scripts.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell*
-  Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted
-  OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+search: '
+  | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from 
+  datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* 
+  Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted OR Registry.registry_value_data=Bypass) 
+  by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
   | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Registry node. You must also be
diff --git a/tests/endpoint/process_execution_via_wmi.test.yml b/tests/endpoint/process_execution_via_wmi.test.yml
index 3c1b9ee8b9..23f82aae83 100644
--- a/tests/endpoint/process_execution_via_wmi.test.yml
+++ b/tests/endpoint/process_execution_via_wmi.test.yml
@@ -2,7 +2,7 @@ name: Process execution via wmi Unit Test
 tests:
 - name: Process execution via wmi
   file: endpoint/process_execution_via_wmi.yml
-  pass_condition: '| stats count | where count = 1'
+  pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:

From 77b300ab4e66b9dbd0d3cc3ed741411ae2f9bd2a Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 15 Feb 2022 09:37:52 -0800
Subject: [PATCH 2/5] Accidentally changed detection file
 detections/cloud/aws_excessive_security_scanning.yml. That file should not
 have been modified.  Rolling back those changes.

---
 detections/cloud/aws_excessive_security_scanning.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml
index 97829915ef..8d8d5bcc48 100644
--- a/detections/cloud/aws_excessive_security_scanning.yml
+++ b/detections/cloud/aws_excessive_security_scanning.yml
@@ -9,12 +9,11 @@ description: This search looks for AWS CloudTrail events and analyse the amount
   eventNames which starts with Describe by a single user. This indicates that this
   user scans the configuration of your AWS cloud environment.
 search: '
-  `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
-  | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
-  | where count > 10 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `o365_excessive_authentication_failures_alert_filter`'
+  `cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  |
+  stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime
+  values(eventName) as eventName values(src) as src values(userAgent) as userAgent
+  by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives.

From a093ba7aaf3278d6eddcaf81c175028c2d368514 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 15 Feb 2022 09:47:36 -0800
Subject: [PATCH 3/5] Minor updates to fixed searches. Fixed some spacing
 issues and quotation mark issues that were causing search success problems.

---
 detections/cloud/aws_excessive_security_scanning.yml |  3 +--
 .../o365_excessive_authentication_failures_alert.yml | 12 +++++++-----
 .../detect_regasm_with_network_connection.yml        | 10 ++++++----
 .../detect_regsvcs_with_network_connection.yml       |  3 +--
 ...ve_session_on_remote_endpoint_with_powershell.yml |  3 +--
 detections/endpoint/net_profiler_uac_bypass.yml      |  5 ++---
 .../powershell_remove_windows_defender_directory.yml |  9 +++++----
 .../process_deleting_its_process_file_path.yml       |  3 +--
 detections/endpoint/rundll32_dnsquery.yml            |  3 +--
 ...ll_execution_policy_to_unrestricted_or_bypass.yml |  3 +--
 10 files changed, 26 insertions(+), 28 deletions(-)

diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml
index 8d8d5bcc48..690360f6f2 100644
--- a/detections/cloud/aws_excessive_security_scanning.yml
+++ b/detections/cloud/aws_excessive_security_scanning.yml
@@ -8,8 +8,7 @@ datamodel: []
 description: This search looks for AWS CloudTrail events and analyse the amount of
   eventNames which starts with Describe by a single user. This indicates that this
   user scans the configuration of your AWS cloud environment.
-search: '
-  `cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  |
+search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  |
   stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime
   values(eventName) as eventName values(src) as src values(userAgent) as userAgent
   by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml
index 73c75b0e8c..47f6b3f960 100644
--- a/detections/cloud/o365_excessive_authentication_failures_alert.yml
+++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml
@@ -7,11 +7,13 @@ type: Anomaly
 datamodel: []
 description: This search detects when an excessive number of authentication failures
   occur this search also includes attempts against MFA prompt codes
-search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=*
-  status=Failed | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod)
-  AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status
-  values(src_ip) AS src_ip by user | where count > 10 |`security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter`'
+search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
+  | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod 
+  values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
+  | where count > 10 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `o365_excessive_authentication_failures_alert_filter`'
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
   works with o365:management:activity
 known_false_positives: The threshold for alert is above 10 attempts and this should
diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml
index bbcab20120..fb41117c3f 100644
--- a/detections/endpoint/detect_regasm_with_network_connection.yml
+++ b/detections/endpoint/detect_regasm_with_network_connection.yml
@@ -15,10 +15,12 @@ description: The following analytic identifies regasm.exe with a network connect
   and review accordingly. Review the reputation of the remote IP or domain and block
   as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
-  process_name=regasm.exe | rename Computer as dest | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip |
-  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`'
+search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regasm.exe 
+  | rename Computer as dest 
+  | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_ip 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `detect_regasm_with_network_connection_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml
index 8bc454037e..7f1a44fea7 100644
--- a/detections/endpoint/detect_regsvcs_with_network_connection.yml
+++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml
@@ -15,8 +15,7 @@ description: The following analytic identifies Regsvcs.exe with a network connec
   and review accordingly. Review the reputation of the remote IP or domain and block
   as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '
-  `sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe 
+search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe 
   | rename Computer as dest 
   | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_ip 
   | `security_content_ctime(firstTime)` 
diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
index 1e4ead1eb5..d7c4fff9ad 100644
--- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
+++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
@@ -10,8 +10,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams
   and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement
   and remote code execution.
-search: '
-  `powershell` EventCode=4104 (Message=""*Enter-PSSession*"" AND Message=""*-ComputerName*"") 
+search: '`powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*") 
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
   | `security_content_ctime(firstTime)` 
   | `interactive_session_on_remote_endpoint_with_powershell_filter` 
diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml
index 895e3caf1d..146efd14ce 100644
--- a/detections/endpoint/net_profiler_uac_bypass.yml
+++ b/detections/endpoint/net_profiler_uac_bypass.yml
@@ -12,10 +12,9 @@ description: This search is to detect modification of registry to bypass UAC win
   the registry key and values in the detection area. It may happened that windows
   update some dll related to mmc.exe and add dll path in this registry. In this case
   filtering is needed.
-search: '
-  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
   from datamodel=Endpoint.Registry where 
-  Registry.registry_path= ""*\\Environment\\COR_PROFILER_PATH"" Registry.registry_value_data = ""*.dll"" 
+  Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_data = "*.dll" 
   by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
   | `drop_dm_object_name(Registry)` 
   | `security_content_ctime(firstTime)` 
diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml
index fe08533824..63baf283fa 100644
--- a/detections/endpoint/powershell_remove_windows_defender_directory.yml
+++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml
@@ -11,10 +11,11 @@ description: This analytic will identify a suspicious PowerShell command used to
   campaign where it used Nirsofts advancedrun.exe to gain administrative privileges
   to then execute a PowerShell command to delete the Windows Defender folder. This
   is a good indicator the offending process is trying corrupt a Windows Defender installation.
-search: '`powershell` EventCode=4104 Message = "* rmdir *" AND Message = "*\\Microsoft\\Windows
-  Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
-  Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `powershell_remove_windows_defender_directory_filter`'
+search: '`powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows Defender*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `powershell_remove_windows_defender_directory_filter` '
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml
index ca5987bc42..7794f47d72 100644
--- a/detections/endpoint/process_deleting_its_process_file_path.yml
+++ b/detections/endpoint/process_deleting_its_process_file_path.yml
@@ -11,8 +11,7 @@ description: This detection is to identify a suspicious process that tries to de
   evasion once a certain condition of malware is satisfied or not. Clop ransomware
   use this technique where it will try to delete its process file path using a .bat
   command if the keyboard layout is not the layout it tries to infect.
-search: '
-  `sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image = "*\\cmd.exe" 
+search: '`sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image = "*\\cmd.exe" 
   | eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") 
   | stats min(_time) as firstTime max(_time) as lastTime count by Computer user ParentImage ParentCommandLine Image CommandLine EventCode ProcessID result 
   | where result = "Found" 
diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml
index 2311ca8aca..c807ae877b 100644
--- a/detections/endpoint/rundll32_dnsquery.yml
+++ b/detections/endpoint/rundll32_dnsquery.yml
@@ -11,8 +11,7 @@ description: This search is to detect a suspicious rundll32.exe process having a
   malware where the rundll32 that execute its payload will contact amazon.com to check
   internet connect and to communicate to its C&C server to download config and other
   file component.
-search: '
-  `sysmon` EventCode=22 process_name="rundll32.exe" 
+search: '`sysmon` EventCode=22 process_name="rundll32.exe" 
   | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId  Computer 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
index 4fbb59fa71..4faec0ffe0 100644
--- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
@@ -8,8 +8,7 @@ datamodel:
 - Endpoint
 description: Monitor for changes of the ExecutionPolicy in the registry to the values
   "unrestricted" or "bypass," which allows the execution of malicious scripts.
-search: '
-  | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from 
   datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* 
   Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted OR Registry.registry_value_data=Bypass) 
   by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.dest 

From 033804472142ce91c52517115d37314bcc1ec9e6 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 18 Feb 2022 10:57:49 -0800
Subject: [PATCH 4/5] Updating the date to today and bumping the version for
 updated searches associated with this PR.

---
 .../cloud/o365_excessive_authentication_failures_alert.yml    | 4 ++--
 detections/endpoint/detect_regasm_with_network_connection.yml | 4 ++--
 .../endpoint/detect_regsvcs_with_network_connection.yml       | 4 ++--
 ...interactive_session_on_remote_endpoint_with_powershell.yml | 4 ++--
 detections/endpoint/net_profiler_uac_bypass.yml               | 4 ++--
 .../endpoint/powershell_remove_windows_defender_directory.yml | 4 ++--
 .../endpoint/process_deleting_its_process_file_path.yml       | 4 ++--
 detections/endpoint/rundll32_dnsquery.yml                     | 4 ++--
 ..._powershell_execution_policy_to_unrestricted_or_bypass.yml | 4 ++--
 9 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml
index 47f6b3f960..65dece8106 100644
--- a/detections/cloud/o365_excessive_authentication_failures_alert.yml
+++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml
@@ -1,7 +1,7 @@
 name: O365 Excessive Authentication Failures Alert
 id: d441364c-349c-453b-b55f-12eccab67cf9
-version: 1
-date: '2020-12-16'
+version: 2
+date: '2022-02-18'
 author: Rod Soto, Splunk
 type: Anomaly
 datamodel: []
diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml
index fb41117c3f..69e22c6034 100644
--- a/detections/endpoint/detect_regasm_with_network_connection.yml
+++ b/detections/endpoint/detect_regasm_with_network_connection.yml
@@ -1,7 +1,7 @@
 name: Detect Regasm with Network Connection
 id: 07921114-6db4-4e2e-ae58-3ea8a52ae93f
-version: 1
-date: '2021-02-16'
+version: 2
+date: '2022-02-18'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml
index 7f1a44fea7..6b7864e696 100644
--- a/detections/endpoint/detect_regsvcs_with_network_connection.yml
+++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml
@@ -1,7 +1,7 @@
 name: Detect Regsvcs with Network Connection
 id: e3e7a1c0-f2b9-445c-8493-f30a63522d1a
-version: 1
-date: '2021-02-16'
+version: 2
+date: '2022-02-18'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
index d7c4fff9ad..243e5e4a99 100644
--- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
+++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
@@ -1,7 +1,7 @@
 name: Interactive Session on Remote Endpoint with PowerShell
 id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af
-version: 1
-date: '2021-11-18'
+version: 2
+date: '2022-02-18'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml
index 6dfef1bea5..dc81093e1c 100644
--- a/detections/endpoint/net_profiler_uac_bypass.yml
+++ b/detections/endpoint/net_profiler_uac_bypass.yml
@@ -1,7 +1,7 @@
 name: NET Profiler UAC bypass
 id: 0252ca80-e30d-11eb-8aa3-acde48001122
-version: 1
-date: '2021-07-12'
+version: 2
+date: '2022-02-18'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml
index 63baf283fa..4a76a32e9a 100644
--- a/detections/endpoint/powershell_remove_windows_defender_directory.yml
+++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml
@@ -1,7 +1,7 @@
 name: Powershell Remove Windows Defender Directory
 id: adf47620-79fa-11ec-b248-acde48001122
-version: 1
-date: '2022-01-20'
+version: 2
+date: '2022-01-18'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml
index 7794f47d72..99179ceec5 100644
--- a/detections/endpoint/process_deleting_its_process_file_path.yml
+++ b/detections/endpoint/process_deleting_its_process_file_path.yml
@@ -1,7 +1,7 @@
 name: Process Deleting Its Process File Path
 id: f7eda4bc-871c-11eb-b110-acde48001122
-version: 1
-date: '2021-03-17'
+version: 2
+date: '2022-02-18'
 author: Teoderick Contreras
 type: TTP
 datamodel:
diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml
index c807ae877b..315305b782 100644
--- a/detections/endpoint/rundll32_dnsquery.yml
+++ b/detections/endpoint/rundll32_dnsquery.yml
@@ -1,7 +1,7 @@
 name: Rundll32 DNSQuery
 id: f1483f5e-ee29-11eb-9d23-acde48001122
-version: 1
-date: '2021-07-26'
+version: 2
+date: '2022-02-18'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
index b01036caed..09fdaff5e6 100644
--- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
@@ -1,7 +1,7 @@
 name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
 id: c2590137-0b08-4985-9ec5-6ae23d92f63d
-version: 6
-date: '2020-11-06'
+version: 7
+date: '2022-02-18'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:

From 9da1af7e8c082028e5a069cdc635f54c731c8321 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Fri, 18 Feb 2022 11:51:32 -0800
Subject: [PATCH 5/5] minor changes for  CIM fields and other metadata

---
 .../endpoint/detect_regasm_with_network_connection.yml      | 6 +++---
 .../endpoint/detect_regsvcs_with_network_connection.yml     | 6 +++---
 ...teractive_session_on_remote_endpoint_with_powershell.yml | 4 +---
 .../endpoint/process_deleting_its_process_file_path.yml     | 6 +++---
 detections/endpoint/rundll32_dnsquery.yml                   | 1 -
 5 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml
index 69e22c6034..dc693a7c50 100644
--- a/detections/endpoint/detect_regasm_with_network_connection.yml
+++ b/detections/endpoint/detect_regasm_with_network_connection.yml
@@ -17,7 +17,7 @@ description: The following analytic identifies regasm.exe with a network connect
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
 search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regasm.exe 
   | rename Computer as dest 
-  | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_ip 
+  | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `detect_regasm_with_network_connection_filter`'
@@ -61,7 +61,7 @@ tags:
     type: User
     role:
     - Victim
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim
@@ -79,7 +79,7 @@ tags:
   - dest_ip
   - process_name
   - Computer
-  - User
+  - user
   - src_ip
   - dest_host
   - dest_ip
diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml
index 6b7864e696..dd41e27b88 100644
--- a/detections/endpoint/detect_regsvcs_with_network_connection.yml
+++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml
@@ -17,7 +17,7 @@ description: The following analytic identifies Regsvcs.exe with a network connec
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
 search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe 
   | rename Computer as dest 
-  | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_ip 
+  | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `detect_regsvcs_with_network_connection_filter`'
@@ -61,7 +61,7 @@ tags:
     type: User
     role:
     - Victim
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim
@@ -79,7 +79,7 @@ tags:
   - dest_ip
   - process_name
   - Computer
-  - User
+  - user
   - src_ip
   - dest_host
   risk_score: 80
diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
index 243e5e4a99..40bdb14ab8 100644
--- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
+++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
@@ -13,9 +13,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
 search: '`powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*") 
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
   | `security_content_ctime(firstTime)` 
-  | `interactive_session_on_remote_endpoint_with_powershell_filter` 
-  | stats count 
-  | where count > 0'
+  | `interactive_session_on_remote_endpoint_with_powershell_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
   can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml
index 99179ceec5..7a93edb934 100644
--- a/detections/endpoint/process_deleting_its_process_file_path.yml
+++ b/detections/endpoint/process_deleting_its_process_file_path.yml
@@ -36,8 +36,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - source:endpoint
-  - stage: Credential Access
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log
   impact: 60
@@ -53,7 +53,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: user
+    type: User
     role:
     - Victim
   product:
diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml
index 315305b782..72503d8052 100644
--- a/detections/endpoint/rundll32_dnsquery.yml
+++ b/detections/endpoint/rundll32_dnsquery.yml
@@ -60,7 +60,6 @@ tags:
   - QueryName
   - QueryStatus
   - ProcessId
-  - direction
   - Computer
   risk_score: 56
   security_domain: endpoint