Branch was auto-updated.

bin/generate.py

@@ -170,7 +170,7 @@ def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_P
     output_path = path.join(OUTPUT_PATH, 'default/savedsearches.conf')
     output = template.render(detections=detections, time=utc_time)
     with open(output_path, 'w') as f:
-        output = output.encode('ascii', 'ignore').decode('ascii')
+        output = output.encode('utf-8', 'ignore').decode('utf-8')
         f.write(output)
 
     return output_path

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -20,12 +20,8 @@ description: 'The following analytic identifies the use of the EncodedCommand Po
   on admin scripts in use. \
 
   Alternatively, may use regex per matching here https://regexr.com/662ov.'
-search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
-  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
-  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
-  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
-  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
-  |\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
+search: 
+  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,

detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml

@@ -15,12 +15,8 @@ description: The following hunting analytic identifies PowerShell commands utili
   For example w, win, windowsty and so forth. In addition, through our research it
   was identified that PowerShell will interpret different command switch types beyond
   the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
-  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
-  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
-  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
-  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
-  |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
+search: 
+  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.