Branch was auto-updated.

detections/endpoint/ssa___windows_bits_job_persistence.yml

@@ -0,0 +1,91 @@
+name: Windows Bits Job Persistence
+id: 1e25e97a-8ea4-11ec-9767-acde48001122
+version: 1
+date: '2022-02-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
+  The query identifies the parameters used to create, resume or add a file to a BITS
+  job. Typically seen combined in a oneliner or ran in sequence. If identified, review
+  the BITS job created and capture any files written to disk. It is possible for BITS
+  to be used to upload files and this may require further network data analysis to
+  identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line, "%setnotifyflags%")
+  OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line, "%setminretrydelay%") OR like (cmd_line,
+  "%setcustomheaders%") OR like (cmd_line, "%resume%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives will be present. Typically, applications
+  will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
+  (legitimate applications) or parent process.
+references:
+- https://attack.mitre.org/techniques/T1197/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
+- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
+tags:
+  analytic_story:
+  - BITS Jobs
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
+  mitre_attack_id:
+  - T1197
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 56
+  security_domain: endpoint

detections/endpoint/ssa___windows_bitsadmin_download_file.yml

@@ -0,0 +1,96 @@
+name: Windows Bitsadmin Download File
+id: d76e8188-8f5a-11ec-ace4-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
+  object. In addition, look for `download` or `upload` on the command-line, the switches
+  are not required to perform a transfer. Capture any files downloaded. Review the
+  reputation of the IP or domain used. Typically once executed, a follow on command
+  will be used to execute the dropped file. Note that the network connection or file
+  modification events related will not spawn or create from `bitsadmin.exe`, but the
+  artifacts will appear in a parallel process of `svchost.exe` with a command-line
+  similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel
+  and child processes to capture any behaviors and artifacts. In some suspicious and
+  malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
+  to list out the jobs during investigation.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives, however it may be required to filter
+  based on parent process name or network connection.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
+- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
+- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
+- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - BITS Jobs
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/ssa___windows_certutil_decode_file.yml

@@ -0,0 +1,90 @@
+name: Windows CertUtil Decode File
+id: b06983f4-8f72-11ec-ab50-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
+  and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
+  and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
+  file that was downloaded. Once decoded, it will be loaded by a parallel process.
+  Note that there are two additional command switches that may be used - `encodehex`
+  and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
+  further execution. During triage, identify the source of the file being decoded.
+  Review its contents or execution behavior for further analysis.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%decode%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Typically seen used to `encode` files, but it is possible to
+  see legitimate use of `decode`. Filter based on parent-child relationship, file
+  paths, endpoint or user.
+references:
+  - https://attack.mitre.org/techniques/T1140/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
+  - https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
+tags:
+  analytic_story:
+  - Deobfuscate-Decode Files or Information
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/ master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file on disk.
+  mitre_attack_id:
+  - T1140
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 40
+  security_domain: endpoint

detections/endpoint/ssa___windows_certutil_urlcache_download.yml

@@ -0,0 +1,87 @@
+name: Windows CertUtil URLCache Download
+id: 8cb1ad38-8f6d-11ec-87a3-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: Certutil.exe may download a file from a remote destination using `-urlcache`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
+  During triage, capture any files on disk and review. Review the reputation of the
+  remote IP or domain in question.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line, "%urlcache%"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. 
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/ssa___windows_certutil_verifyctl_download.yml

@@ -0,0 +1,88 @@
+name: Windows CertUtil VerifyCtl Download
+id: 9ac29c40-8f6b-11ec-b19a-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  \ During triage, capture any files on disk and review. Review the reputation of
+  the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
+  written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line, "%verifyctl%"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. 
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml

@@ -0,0 +1,88 @@
+name: Windows PowerShell Start-BitsTransfer
+id: 0bafd086-8f61-11ec-996e-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar
+  functionality is present. This technique variation is not as commonly used by adversaries,
+  but has been abused in the past. Lesser known uses include the ability to set the
+  `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload`
+  is used, it is highly possible files will be archived. During triage, review parallel
+  processes and process lineage. Capture any files on disk and review. For the remote
+  domain or IP, what is the reputation?
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
+  (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Limited false positives. It is possible administrators will
+  utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
+  process or command-line arguments.
+references:
+- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
+- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
+tags:
+  analytic_story:
+  - BITS Jobs
+  - Living Off The Land
+  automated_detection_testing: passed
+  cis20: []
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/ssa___windows_rasautou_dll_execution.yml

@@ -0,0 +1,79 @@
+name: Windows Rasautou DLL Execution
+id: 6f42b8ce-1e15-11ec-ad5a-acde48001122
+version: 1
+date: '2022-02-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. 
+  During triage, review parent and child process behavior including file and image loads.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe"
+  AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
+references:
+  - https://github.com/mandiant/DueDLLigence
+  - https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
+  - https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 
+  - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Living Off The Land
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055.001
+  - T1218
+  - T1055
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -20,20 +20,18 @@ references:
 risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
   on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
   that warrants investigating.
-search: '| from read_ssa_enriched_events()
-
-  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
-  | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
-  parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
-  null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event,
-  "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
-  "string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null)
-  | where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"),
+  "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"),
+  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string",
+  null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
+  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,"event_id"),
+  "string", null) | where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
   | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe"
   OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
   OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
   OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
-  AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%patch1-Hotfix1a%"))))
+  AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)patch1-Hotfix1a/)=false)))
   OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
   IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,

dist/ssa/srs/ssa___windows_bits_job_persistence.yml

@@ -0,0 +1,106 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-15'
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
+  The query identifies the parameters used to create, resume or add a file to a BITS
+  job. Typically seen combined in a oneliner or ran in sequence. If identified, review
+  the BITS job created and capture any files written to disk. It is possible for BITS
+  to be used to upload files and this may require further network data analysis to
+  identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 1e25e97a-8ea4-11ec-9767-acde48001122
+known_false_positives: Limited false positives will be present. Typically, applications
+  will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
+  (legitimate applications) or parent process.
+name: Windows Bits Job Persistence
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1197/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
+- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line,
+  "%setnotifyflags%") OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line,
+  "%setminretrydelay%") OR like (cmd_line, "%setcustomheaders%") OR like (cmd_line,
+  "%resume%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - BITS Jobs
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
+  mitre_attack_id:
+  - T1197
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 56
+  risk_severity: medium
+  security_domain: endpoint
+test:
+  name: Windows Bits Job Persistence Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+      file_name: bits-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_bits_job_persistence.yml
+    name: Windows Bits Job Persistence
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml

@@ -0,0 +1,110 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
+  object. In addition, look for `download` or `upload` on the command-line, the switches
+  are not required to perform a transfer. Capture any files downloaded. Review the
+  reputation of the IP or domain used. Typically once executed, a follow on command
+  will be used to execute the dropped file. Note that the network connection or file
+  modification events related will not spawn or create from `bitsadmin.exe`, but the
+  artifacts will appear in a parallel process of `svchost.exe` with a command-line
+  similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel
+  and child processes to capture any behaviors and artifacts. In some suspicious and
+  malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
+  to list out the jobs during investigation.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: d76e8188-8f5a-11ec-ace4-acde48001122
+known_false_positives: Limited false positives, however it may be required to filter
+  based on parent process name or network connection.
+name: Windows Bitsadmin Download File
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
+- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
+- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
+- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
+  "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - BITS Jobs
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: Windows Bitsadmin Download File Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+      file_name: bits-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_bitsadmin_download_file.yml
+    name: Windows Bitsadmin Download File
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_certutil_decode_file.yml

@@ -0,0 +1,106 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
+  and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
+  and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
+  file that was downloaded. Once decoded, it will be loaded by a parallel process.
+  Note that there are two additional command switches that may be used - `encodehex`
+  and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
+  further execution. During triage, identify the source of the file being decoded.
+  Review its contents or execution behavior for further analysis.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: b06983f4-8f72-11ec-ab50-acde48001122
+known_false_positives: Typically seen used to `encode` files, but it is possible to
+  see legitimate use of `decode`. Filter based on parent-child relationship, file
+  paths, endpoint or user.
+name: Windows CertUtil Decode File
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1140/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
+- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file
+  on disk.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%decode%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
+  "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Deobfuscate-Decode Files or Information
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/ master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file
+    on disk.
+  mitre_attack_id:
+  - T1140
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 40
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: Windows CertUtil Decode File Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_certutil_decode_file.yml
+    name: Windows CertUtil Decode File
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml

@@ -0,0 +1,101 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: Certutil.exe may download a file from a remote destination using `-urlcache`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
+  During triage, capture any files on disk and review. Review the reputation of the
+  remote IP or domain in question.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 8cb1ad38-8f6d-11ec-87a3-acde48001122
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+name: Windows CertUtil URLCache Download
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
+  "%urlcache%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows CertUtil URLCache Download Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+      file_name: T1105-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_certutil_urlcache_download.yml
+    name: Windows CertUtil URLCache Download
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml

@@ -0,0 +1,102 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  \ During triage, capture any files on disk and review. Review the reputation of
+  the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
+  written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 9ac29c40-8f6b-11ec-b19a-acde48001122
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+name: Windows CertUtil VerifyCtl Download
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
+  "%verifyctl%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows CertUtil VerifyCtl Download  Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+      file_name: T1105-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_certutil_verifyctl_download_.yml
+    name: Windows CertUtil VerifyCtl Download
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml

@@ -0,0 +1,99 @@
+author: Lou Stella, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-17'
+description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server.
+  It has a scripting mode intended for complex scripted backup operations. This feature
+  also allows for execution of arbitrary unsigned code. This analytic looks for the
+  usage of the scripting mode flags in executions of DiskShadow. During triage, compare
+  to known backup behavior in your environment and then review the scripts called
+  by diskshadow.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on processes that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+id: aa502688-9037-11ec-842d-acde48001122
+known_false_positives: Administrators using the DiskShadow tool in their infrastructure
+  as a main backup tool with scripts will cause false positives
+name: Windows Diskshadow Proxy Execution
+product:
+- Splunk Behavioral Analytics
+references:
+- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event,
+  "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="diskshadow.exe"
+  AND (like (cmd_line, "%-s%") OR like (cmd_line, "%/s%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
+  mitre_attack_id:
+  - T1218
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: BA Windows Diskshadow Proxy Execution Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_diskshadow_proxy_execution.yml
+    name: BA Windows Diskshadow Proxy Execution
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 1

dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml

@@ -0,0 +1,99 @@
+author: Lou Stella, Splunk
+datamodel:
+- Endpoint_Registry
+date: '2022-02-18'
+description: The following search identifies Eventvwr bypass by identifying the registry
+  modification into a specific path that eventvwr.msc looks to (but is not valid)
+  upon execution. A successful attack will include a suspicious command to be executed
+  upon eventvwr.msc loading. Upon triage, review the parallel processes that have
+  executed. Identify any additional registry modifications on the endpoint that may
+  look suspicious. Remediate as necessary.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Registry` datamodel.
+id: 66adff66-90d9-11ec-aba7-acde48001122
+known_false_positives: None known at this time.
+name: Windows Eventvwr UAC Bypass
+product:
+- Splunk Behavioral Analytics
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://attack.mitre.org/techniques/T1548/002
+- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
+risk_message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)),
+  registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)),
+  registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string",
+  null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"),
+  "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"),
+  "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"),
+  "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"),
+  "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive",
+  registry_hive, "registry_value_name", registry_value_name, "registry_key_name",
+  registry_key_name, "registry_value_type", registry_value_type, "registry_value_data",
+  registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - IcedID
+  - Living Off The Land
+  cis20:
+  - CIS 14
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+  impact: 80
+  kill_chain_phases:
+  - Privilege Escalation
+  message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  nist:
+  - DE.AE
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - event_id
+  - registry_path
+  - registry_hive
+  - registry_value_name
+  - registry_key_name
+  - registry_value_type
+  - registry_value_data
+  - process_guid
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows Eventvwr UAC Bypass Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+      file_name: windows-sysmon-registry.log
+      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+      sourcetype: xmlwineventlog
+    file: endpoint/ssa___windows_eventvwr_uac_bypass.yml
+    name: Windows Eventvwr UAC Bypass
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 1

dist/ssa/srs/ssa___windows_powershell_start-bitstransfer.yml

@@ -0,0 +1,103 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar
+  functionality is present. This technique variation is not as commonly used by adversaries,
+  but has been abused in the past. Lesser known uses include the ability to set the
+  `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload`
+  is used, it is highly possible files will be archived. During triage, review parallel
+  processes and process lineage. Capture any files on disk and review. For the remote
+  domain or IP, what is the reputation?
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+id: 0bafd086-8f61-11ec-996e-acde48001122
+known_false_positives: Limited false positives. It is possible administrators will
+  utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
+  process or command-line arguments.
+name: Windows PowerShell Start-BitsTransfer
+product:
+- Splunk Behavioral Analytics
+references:
+- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
+- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
+  (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - BITS Jobs
+  - Living Off The Land
+  automated_detection_testing: passed
+  cis20: []
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: Windows PowerShell Start-BitsTransfer Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
+      file_name: T1197_windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_powershell_start_bitstransfer.yml
+    name: Windows PowerShell Start-BitsTransfer
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml

@@ -0,0 +1,101 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-15'
+description: The following analytic identifies the Windows Windows Remote Auto Dialer,
+  rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary
+  shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review
+  parent and child process behavior including file and image loads.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 6f42b8ce-1e15-11ec-ad5a-acde48001122
+known_false_positives: False positives will be limited to applications that require
+  Rasautou.exe to load a DLL from disk. Filter as needed.
+name: Windows Rasautou DLL Execution
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/mandiant/DueDLLigence
+- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
+- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513
+- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe"
+  AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Living Off The Land
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+  mitre_attack_id:
+  - T1055.001
+  - T1218
+  - T1055
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows Rasautou DLL Execution Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_rasautou_dll_execution.yml
+    name: Windows Rasautou DLL Execution
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

tests/endpoint/ssa___windows_bits_job_persistence.test.yml

@@ -0,0 +1,9 @@
+name: Windows Bits Job Persistence Unit Test
+tests:
+- name: Windows Bits Job Persistence
+  file: endpoint/ssa___windows_bits_job_persistence.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: bits-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+    source: WinEventLog:Security

tests/endpoint/ssa___windows_bitsadmin_download_file.test.yml

@@ -0,0 +1,9 @@
+name: Windows Bitsadmin Download File Unit Test
+tests:
+- name: Windows Bitsadmin Download File
+  file: endpoint/ssa___windows_bitsadmin_download_file.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: bits-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+    source: WinEventLog:Security

tests/endpoint/ssa___windows_certutil_decode_file.test.yml

@@ -0,0 +1,9 @@
+name: Windows CertUtil Decode File Unit Test
+tests:
+- name: Windows CertUtil Decode File
+  file: endpoint/ssa___windows_certutil_decode_file.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
+    source: WinEventLog:Security

tests/endpoint/ssa___windows_certutil_urlcache_download.test.yml

@@ -0,0 +1,9 @@
+name: Windows CertUtil URLCache Download Unit Test
+tests:
+- name: Windows CertUtil URLCache Download
+  file: endpoint/ssa___windows_certutil_urlcache_download.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: T1105-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+    source: WinEventLog:Security

tests/endpoint/ssa___windows_certutil_verifyctl_download.test.yml

@@ -0,0 +1,9 @@
+name: Windows CertUtil VerifyCtl Download  Unit Test
+tests:
+- name: Windows CertUtil VerifyCtl Download 
+  file: endpoint/ssa___windows_certutil_verifyctl_download_.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: T1105-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+    source: WinEventLog:Security

tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml

@@ -0,0 +1,9 @@
+name: Windows PowerShell Start-BitsTransfer Unit Test
+tests:
+- name: Windows PowerShell Start-BitsTransfer
+  file: endpoint/ssa___windows_powershell_start_bitstransfer.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: T1197_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
+    source: WinEventLog:Security

tests/endpoint/ssa___windows_rasautou_dll_execution.test.yml

@@ -0,0 +1,9 @@
+name: Windows Rasautou DLL Execution Unit Test
+tests:
+- name: Windows Rasautou DLL Execution
+  file: endpoint/ssa___windows_rasautou_dll_execution.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
+    source: WinEventLog:Security