Merge branch 'TR-1085_LateralMovement' of https://github.com/splunk/security_content into TR-1085_LateralMovement

detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml

@@ -7,19 +7,20 @@ type: TTP
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `schtasks.exe` with command-line
-  arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and 
-  adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution.
+  arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and
+  adversaries alike may abuse the Task Scheduler for lateral movement and remote code
+  execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe
   OR Processes.original_file_name=schtasks.exe) (Processes.process=*/s* AND Processes.process=*/run*)
-  by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_initiation_on_remote_endpoint_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
- logs with the process name, parent process, and command-line executions from your endpoints.
-known_false_positives: Administrators may start scheduled tasks on remote systems, but this
-  activity is usually limited to a small set of hosts or users.
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may start scheduled tasks on remote systems,
+  but this activity is usually limited to a small set of hosts or users.
 references:
 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
 - https://attack.mitre.org/techniques/T1053/005/
@@ -52,7 +53,7 @@ tags:
   - Processes.parent_process_id
   security_domain: endpoint
   impact: 90
-  confidence: 60 
+  confidence: 60
   risk_score: 54
   context:
   - Source:Endpoint
@@ -63,4 +64,4 @@ tags:
     type: Endpoint
     role:
     - Victim
-  
+  automated_detection_testing: passed