From 9ba8b98bb7a59b4b06e5e87ab69423b98fe2b1a1 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Feb 2022 14:09:25 -0700
Subject: [PATCH 01/16] SSA Rasautou

---
 .../ssa___windows_rasautou_dll_execution.yml  | 80 +++++++++++++++++++
 ...___windows_rasautou_dll_execution.test.yml |  9 +++
 2 files changed, 89 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_rasautou_dll_execution.yml
 create mode 100644 tests/endpoint/ssa___windows_rasautou_dll_execution.test.yml

diff --git a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
new file mode 100644
index 0000000000..f46482b50e
--- /dev/null
+++ b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
@@ -0,0 +1,80 @@
+name: Windows Rasautou DLL Execution
+id: 6f42b8be-8e96-11ec-ad5a-acde48001122
+version: 1
+date: '2022-02-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. 
+  During triage, review parent and child process behavior including file and image loads.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe"
+  AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();''
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
+references:
+  - https://github.com/mandiant/DueDLLigence
+  - https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
+  - https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 
+  - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055.001
+  - T1218
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_rasautou_dll_execution.test.yml b/tests/endpoint/ssa___windows_rasautou_dll_execution.test.yml
new file mode 100644
index 0000000000..d617f00e0b
--- /dev/null
+++ b/tests/endpoint/ssa___windows_rasautou_dll_execution.test.yml
@@ -0,0 +1,9 @@
+name: Windows Rasautou DLL Execution Unit Test
+tests:
+- name: Windows Rasautou DLL Execution
+  file: endpoint/ssa___windows_rasautou_dll_execution.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file

From c708484703c96c17782cdb9ebbc04bd6355badfb Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Feb 2022 14:14:16 -0700
Subject: [PATCH 02/16] oops

---
 detections/endpoint/ssa___windows_rasautou_dll_execution.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
index f46482b50e..89ddec23e7 100644
--- a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
+++ b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
@@ -1,5 +1,5 @@
 name: Windows Rasautou DLL Execution
-id: 6f42b8be-8e96-11ec-ad5a-acde48001122
+id: 6f42b8ce-1e15-11ec-ad5a-acde48001122
 version: 1
 date: '2022-02-15'
 author: Michael Haag, Splunk

From 9082c7c43d3ac975a3518db9d58cb02dc2d02f65 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Feb 2022 14:34:11 -0700
Subject: [PATCH 03/16] Windows Bits Job Persistence

---
 .../ssa___windows_bits_job_persistence.yml    | 96 +++++++++++++++++++
 .../ssa___windows_rasautou_dll_execution.yml  |  2 +-
 2 files changed, 97 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/ssa___windows_bits_job_persistence.yml

diff --git a/detections/endpoint/ssa___windows_bits_job_persistence.yml b/detections/endpoint/ssa___windows_bits_job_persistence.yml
new file mode 100644
index 0000000000..2a95e98e52
--- /dev/null
+++ b/detections/endpoint/ssa___windows_bits_job_persistence.yml
@@ -0,0 +1,96 @@
+name: Windows Bits Job Persistence
+id: 1e25e97a-8ea4-11ec-9767-acde48001122
+version: 1
+date: '2022-02-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
+  The query identifies the parameters used to create, resume or add a file to a BITS
+  job. Typically seen combined in a oneliner or ran in sequence. If identified, review
+  the BITS job created and capture any files written to disk. It is possible for BITS
+  to be used to upload files and this may require further network data analysis to
+  identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line, "%setnotifyflags%")
+  OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line, "%setminretrydelay%") OR like (cmd_line,
+  "%setcustomheaders%") OR like (cmd_line, "%resume%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives will be present. Typically, applications
+  will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
+  (legitimate applications) or parent process.
+references:
+- https://attack.mitre.org/techniques/T1197/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
+- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
+tags:
+  analytic_story:
+  - BITS Jobs
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to persist using BITS.
+  mitre_attack_id:
+  - T1197
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
index 89ddec23e7..f13a226f93 100644
--- a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
+++ b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
@@ -5,7 +5,7 @@ date: '2022-02-15'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. 
   During triage, review parent and child process behavior including file and image loads.
 search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)

From 6b6727b3d7849b5f2071684cfe55bbf99fd69465 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 16 Feb 2022 12:19:01 -0700
Subject: [PATCH 04/16] BITS

---
 .../ssa___windows_bits_job_persistence.yml    | 28 +++---
 .../ssa___windows_bitsadmin_download_file.yml | 95 +++++++++++++++++++
 .../ssa___windows_rasautou_dll_execution.yml  | 30 +++---
 ...sa___windows_bits_job_persistence.test.yml |  9 ++
 ...__windows_bitsadmin_download_file.test.yml |  9 ++
 5 files changed, 138 insertions(+), 33 deletions(-)
 create mode 100644 detections/endpoint/ssa___windows_bitsadmin_download_file.yml
 create mode 100644 tests/endpoint/ssa___windows_bits_job_persistence.test.yml
 create mode 100644 tests/endpoint/ssa___windows_bitsadmin_download_file.test.yml

diff --git a/detections/endpoint/ssa___windows_bits_job_persistence.yml b/detections/endpoint/ssa___windows_bits_job_persistence.yml
index 2a95e98e52..90f86d36ef 100644
--- a/detections/endpoint/ssa___windows_bits_job_persistence.yml
+++ b/detections/endpoint/ssa___windows_bits_job_persistence.yml
@@ -55,15 +55,15 @@ tags:
   kill_chain_phases:
   - Exploitation
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to persist using BITS.
+    on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
   mitre_attack_id:
   - T1197
   observable:
-  - name: user
+  - name: dest_user_id
     type: User
     role:
     - Victim
-  - name: dest
+  - name: dest_device_id
     type: Hostname
     role:
     - Victim
@@ -76,21 +76,15 @@ tags:
     role:
     - Child Process
   product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
+  - Splunk Behavioral Analytics
   required_fields:
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml
new file mode 100644
index 0000000000..4db79b5266
--- /dev/null
+++ b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml
@@ -0,0 +1,95 @@
+name: Windows Bitsadmin Download File
+id: d76e8188-8f5a-11ec-ace4-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
+  object. In addition, look for `download` or `upload` on the command-line, the switches
+  are not required to perform a transfer. Capture any files downloaded. Review the
+  reputation of the IP or domain used. Typically once executed, a follow on command
+  will be used to execute the dropped file. Note that the network connection or file
+  modification events related will not spawn or create from `bitsadmin.exe`, but the
+  artifacts will appear in a parallel process of `svchost.exe` with a command-line
+  similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel
+  and child processes to capture any behaviors and artifacts. In some suspicious and
+  malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
+  to list out the jobs during investigation.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_pyline, "%transfer%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives, however it may be required to filter
+  based on parent process name or network connection.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
+- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
+- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
+- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - BITS Jobs
+  - DarkSide Ransomware
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
index f13a226f93..7299d8c16a 100644
--- a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
+++ b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
@@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data
   "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
   | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name, "process_path", process_path])
-  | into write_ssa_detected_events();''
+  | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
 references:
@@ -40,22 +40,16 @@ tags:
   - T1218
   - T1055
   product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
+  - Splunk Behavioral Analytics
   required_fields:
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
   security_domain: endpoint
   impact: 80
   confidence: 100
@@ -66,7 +60,11 @@ tags:
   - Stage:Defense Evasion
   message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
   observable:
-  - name: dest
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
     type: Hostname
     role:
     - Victim
diff --git a/tests/endpoint/ssa___windows_bits_job_persistence.test.yml b/tests/endpoint/ssa___windows_bits_job_persistence.test.yml
new file mode 100644
index 0000000000..3eabc78bcc
--- /dev/null
+++ b/tests/endpoint/ssa___windows_bits_job_persistence.test.yml
@@ -0,0 +1,9 @@
+name: Windows Bits Job Persistence Unit Test
+tests:
+- name: Windows Bits Job Persistence
+  file: endpoint/ssa___windows_bits_job_persistence.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: bits-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_bitsadmin_download_file.test.yml b/tests/endpoint/ssa___windows_bitsadmin_download_file.test.yml
new file mode 100644
index 0000000000..1ad73b02a0
--- /dev/null
+++ b/tests/endpoint/ssa___windows_bitsadmin_download_file.test.yml
@@ -0,0 +1,9 @@
+name: Windows Bitsadmin Download File Unit Test
+tests:
+- name: Windows Bitsadmin Download File
+  file: endpoint/ssa___windows_bitsadmin_download_file.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: bits-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file

From 87aad0493ce2a1653912e585a4d9898972c28db9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 16 Feb 2022 13:16:13 -0700
Subject: [PATCH 05/16] start-bitstransfer

---
 .../ssa___windows_bitsadmin_download_file.yml |  2 +-
 ..._windows_powershell_start_bitstransfer.yml | 86 +++++++++++++++++++
 ...ows_powershell_start_bitstransfer.test.yml |  9 ++
 3 files changed, 96 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
 create mode 100644 tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml

diff --git a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml
index 4db79b5266..bf5e67aa59 100644
--- a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml
+++ b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml
@@ -54,7 +54,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
new file mode 100644
index 0000000000..1db53c5774
--- /dev/null
+++ b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
@@ -0,0 +1,86 @@
+name: Windows PowerShell Start-BitsTransfer
+id: 0bafd086-8f61-11ec-996e-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar
+  functionality is present. This technique variation is not as commonly used by adversaries,
+  but has been abused in the past. Lesser known uses include the ability to set the
+  `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload`
+  is used, it is highly possible files will be archived. During triage, review parallel
+  processes and process lineage. Capture any files on disk and review. For the remote
+  domain or IP, what is the reputation?
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="powershell.exe"
+  AND (like (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Limited false positives. It is possible administrators will
+  utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
+  process or command-line arguments.
+references:
+- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
+- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
+tags:
+  analytic_story:
+  - BITS Jobs
+  automated_detection_testing: passed
+  cis20: []
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  security_domain: endpoint
diff --git a/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml b/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml
new file mode 100644
index 0000000000..d25253492b
--- /dev/null
+++ b/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml
@@ -0,0 +1,9 @@
+name: Windows PowerShell Start-BitsTransfer Unit Test
+tests:
+- name: Windows PowerShell Start-BitsTransfer
+  file: endpoint/ssa___windows_powershell_start_bitstransfer.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: bits-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file

From 271ee724c5d9e4f4029e21ba198fa7f56b577775 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 16 Feb 2022 14:09:18 -0700
Subject: [PATCH 06/16] certutil - verifyctl

---
 ...___windows_certutil_verifyctl_download.yml | 90 +++++++++++++++++++
 ...ndows_certutil_verifyctl_download.test.yml |  9 ++
 2 files changed, 99 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
 create mode 100644 tests/endpoint/ssa___windows_certutil_verifyctl_download.test.yml

diff --git a/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
new file mode 100644
index 0000000000..0e557ab3d0
--- /dev/null
+++ b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
@@ -0,0 +1,90 @@
+name: Windows CertUtil VerifyCtl Download
+id: 9ac29c40-8f6b-11ec-b19a-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  \ During triage, capture any files on disk and review. Review the reputation of
+  the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
+  written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe"
+  AND (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%")
+  OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line,
+  "%--progress%") OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line,
+  "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") OR like (cmd_line,
+  "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. 
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
diff --git a/tests/endpoint/ssa___windows_certutil_verifyctl_download.test.yml b/tests/endpoint/ssa___windows_certutil_verifyctl_download.test.yml
new file mode 100644
index 0000000000..2183a1f706
--- /dev/null
+++ b/tests/endpoint/ssa___windows_certutil_verifyctl_download.test.yml
@@ -0,0 +1,9 @@
+name: Windows CertUtil VerifyCtl Download  Unit Test
+tests:
+- name: Windows CertUtil VerifyCtl Download 
+  file: endpoint/ssa___windows_certutil_verifyctl_download_.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: T1105-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file

From eecd75c4a9b0721ae873be8e20944474e7bb5240 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 16 Feb 2022 14:24:50 -0700
Subject: [PATCH 07/16] urlcache

---
 ...a___windows_certutil_urlcache_download.yml | 86 +++++++++++++++++++
 ...___windows_certutil_verifyctl_download.yml |  9 +-
 ...indows_certutil_urlcache_download.test.yml |  9 ++
 3 files changed, 98 insertions(+), 6 deletions(-)
 create mode 100644 detections/endpoint/ssa___windows_certutil_urlcache_download.yml
 create mode 100644 tests/endpoint/ssa___windows_certutil_urlcache_download.test.yml

diff --git a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
new file mode 100644
index 0000000000..244afa2e5d
--- /dev/null
+++ b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
@@ -0,0 +1,86 @@
+name: Windows CertUtil URLCache Download
+id: 8cb1ad38-8f6d-11ec-87a3-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: Certutil.exe may download a file from a remote destination using `-urlcache`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
+  During triage, capture any files on disk and review. Review the reputation of the
+  remote IP or domain in question.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line, "%urlcache%"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. 
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
index 0e557ab3d0..53795c5bd6 100644
--- a/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
+++ b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
@@ -19,12 +19,9 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data
   "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
   "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
   "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
-  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe"
-  AND (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%")
-  OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line,
-  "%--progress%") OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line,
-  "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") OR like (cmd_line,
-  "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) | eval start_time=timestamp,
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line, "%verifyctl%"))
+  | eval start_time=timestamp,
   end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
   "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
   | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
diff --git a/tests/endpoint/ssa___windows_certutil_urlcache_download.test.yml b/tests/endpoint/ssa___windows_certutil_urlcache_download.test.yml
new file mode 100644
index 0000000000..939e25e254
--- /dev/null
+++ b/tests/endpoint/ssa___windows_certutil_urlcache_download.test.yml
@@ -0,0 +1,9 @@
+name: Windows CertUtil URLCache Download Unit Test
+tests:
+- name: Windows CertUtil URLCache Download
+  file: endpoint/ssa___windows_certutil_urlcache_download.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: T1105-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file

From 252ed2576ff3e5bb71c887e6489dd3b443ba1ff4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 16 Feb 2022 14:30:10 -0700
Subject: [PATCH 08/16] Update ssa___windows_certutil_urlcache_download.yml

---
 .../endpoint/ssa___windows_certutil_urlcache_download.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
index 244afa2e5d..4d42ecf8c3 100644
--- a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
+++ b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
@@ -5,7 +5,7 @@ date: '2022-02-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: Certutil.exe may download a file from a remote destination using `-urlcache`.
   This behavior does require a URL to be passed on the command-line. In addition,
   `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will

From cf94f81798ee1430a379ed3fc7367c7985ec6c07 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 17 Feb 2022 10:10:49 -0700
Subject: [PATCH 09/16] Windows CertUtil Decode File

---
 .../ssa___windows_certutil_decode_file.yml    | 89 +++++++++++++++++++
 ...sa___windows_certutil_decode_file.test.yml |  9 ++
 2 files changed, 98 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_certutil_decode_file.yml
 create mode 100644 tests/endpoint/ssa___windows_certutil_decode_file.test.yml

diff --git a/detections/endpoint/ssa___windows_certutil_decode_file.yml b/detections/endpoint/ssa___windows_certutil_decode_file.yml
new file mode 100644
index 0000000000..ce33b4835a
--- /dev/null
+++ b/detections/endpoint/ssa___windows_certutil_decode_file.yml
@@ -0,0 +1,89 @@
+name: Windows CertUtil Decode File
+id: b06983f4-8f72-11ec-ab50-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
+  and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
+  and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
+  file that was downloaded. Once decoded, it will be loaded by a parallel process.
+  Note that there are two additional command switches that may be used - `encodehex`
+  and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
+  further execution. During triage, identify the source of the file being decoded.
+  Review its contents or execution behavior for further analysis.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%decode%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Typically seen used to `encode` files, but it is possible to
+  see legitimate use of `decode`. Filter based on parent-child relationship, file
+  paths, endpoint or user.
+references:
+  - https://attack.mitre.org/techniques/T1140/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
+  - https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
+tags:
+  analytic_story:
+  - Deobfuscate-Decode Files or Information
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/ master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file on disk.
+  mitre_attack_id:
+  - T1140
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 40
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_certutil_decode_file.test.yml b/tests/endpoint/ssa___windows_certutil_decode_file.test.yml
new file mode 100644
index 0000000000..795b187b5d
--- /dev/null
+++ b/tests/endpoint/ssa___windows_certutil_decode_file.test.yml
@@ -0,0 +1,9 @@
+name: Windows CertUtil Decode File Unit Test
+tests:
+- name: Windows CertUtil Decode File
+  file: endpoint/ssa___windows_certutil_decode_file.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file

From dfb089db4e451a244f4fcf990f44b860be7cc67c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 22 Feb 2022 14:58:49 -0700
Subject: [PATCH 10/16] Update ssa___windows_certutil_decode_file.yml

---
 detections/endpoint/ssa___windows_certutil_decode_file.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_certutil_decode_file.yml b/detections/endpoint/ssa___windows_certutil_decode_file.yml
index ce33b4835a..a6e43eac7f 100644
--- a/detections/endpoint/ssa___windows_certutil_decode_file.yml
+++ b/detections/endpoint/ssa___windows_certutil_decode_file.yml
@@ -5,7 +5,7 @@ date: '2022-02-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
   and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
   and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded

From e61f56eb055cf924f66d1dd720e5d73ace3f3b2c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 22 Feb 2022 15:13:43 -0700
Subject: [PATCH 11/16] Update ssa___windows_bitsadmin_download_file.yml

---
 detections/endpoint/ssa___windows_bitsadmin_download_file.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml
index bf5e67aa59..9a5b2f07f4 100644
--- a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml
+++ b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml
@@ -25,7 +25,7 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data
   "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
   "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
   | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
-  AND (like (cmd_pyline, "%transfer%")) | eval start_time=timestamp,
+  AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp,
   end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
   "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
   | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",

From 02684a07410c64828f40c86ca5d0f7cec800c7c5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 23 Feb 2022 09:56:45 -0700
Subject: [PATCH 12/16] Fixed Powershell Bits

---
 .../endpoint/ssa___windows_powershell_start_bitstransfer.yml  | 2 +-
 .../ssa___windows_powershell_start_bitstransfer.test.yml      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
index 1db53c5774..0b39967922 100644
--- a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
+++ b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
@@ -45,7 +45,7 @@ tags:
   - Source:Endpoint
   - Stage:Exfiltration
   dataset:
-    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
   impact: 70
   kill_chain_phases:
   - Exploitation
diff --git a/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml b/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml
index d25253492b..a3f44da9d0 100644
--- a/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml
+++ b/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml
@@ -4,6 +4,6 @@ tests:
   file: endpoint/ssa___windows_powershell_start_bitstransfer.yml
   pass_condition: '@count_gt(0)'
   attack_data:
-  - file_name: bits-windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  - file_name: T1197_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
     source: WinEventLog:Security
\ No newline at end of file

From d90e9559baff82a5c5b8a56f8a297cf12be98b0f Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 23 Feb 2022 10:34:13 -0700
Subject: [PATCH 13/16] logic issue

---
 .../ssa___windows_powershell_start_bitstransfer.yml         | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
index 0b39967922..9667316393 100644
--- a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
+++ b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
@@ -19,8 +19,10 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data
   "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
   "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
   "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
-  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="powershell.exe"
-  AND (like (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp,
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
+  (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp,
   end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
   "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
   | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",

From 1012679be3add09ade7a42a7a15ff896f502c7a5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 23 Feb 2022 10:48:09 -0700
Subject: [PATCH 14/16] working bits

---
 ..._windows_powershell_start_bitstransfer.yml | 21 +++++++++----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
index 9667316393..3a1547b905 100644
--- a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
+++ b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
@@ -13,19 +13,18 @@ description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Si
   is used, it is highly possible files will be archived. During triage, review parallel
   processes and process lineage. Capture any files on disk and review. For the remote
   domain or IP, what is the reputation?
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
-  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
-  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
-  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
-  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
-  | where cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
   OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
   OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
-  (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp,
-  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
-  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
-  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name, "process_path", process_path])
   | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information

From 1bddc5433aa08b1f9228fc1994722b22419a16de Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 23 Feb 2022 14:18:24 -0700
Subject: [PATCH 15/16] analytic story

---
 detections/endpoint/ssa___windows_bits_job_persistence.yml       | 1 +
 detections/endpoint/ssa___windows_bitsadmin_download_file.yml    | 1 +
 detections/endpoint/ssa___windows_certutil_decode_file.yml       | 1 +
 detections/endpoint/ssa___windows_certutil_urlcache_download.yml | 1 +
 .../endpoint/ssa___windows_certutil_verifyctl_download.yml       | 1 +
 .../endpoint/ssa___windows_powershell_start_bitstransfer.yml     | 1 +
 detections/endpoint/ssa___windows_rasautou_dll_execution.yml     | 1 +
 7 files changed, 7 insertions(+)

diff --git a/detections/endpoint/ssa___windows_bits_job_persistence.yml b/detections/endpoint/ssa___windows_bits_job_persistence.yml
index 90f86d36ef..8a0d8a1285 100644
--- a/detections/endpoint/ssa___windows_bits_job_persistence.yml
+++ b/detections/endpoint/ssa___windows_bits_job_persistence.yml
@@ -44,6 +44,7 @@ references:
 tags:
   analytic_story:
   - BITS Jobs
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 80
   context:
diff --git a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml
index 9a5b2f07f4..e84abf65c9 100644
--- a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml
+++ b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml
@@ -48,6 +48,7 @@ tags:
   - Ingress Tool Transfer
   - BITS Jobs
   - DarkSide Ransomware
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/ssa___windows_certutil_decode_file.yml b/detections/endpoint/ssa___windows_certutil_decode_file.yml
index a6e43eac7f..fae5ef1811 100644
--- a/detections/endpoint/ssa___windows_certutil_decode_file.yml
+++ b/detections/endpoint/ssa___windows_certutil_decode_file.yml
@@ -43,6 +43,7 @@ references:
 tags:
   analytic_story:
   - Deobfuscate-Decode Files or Information
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 80
   context:
diff --git a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
index 4d42ecf8c3..1d7955ddc4 100644
--- a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
+++ b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
@@ -40,6 +40,7 @@ tags:
   analytic_story:
   - Ingress Tool Transfer
   - DarkSide Ransomware
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 100
   context:
diff --git a/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
index 53795c5bd6..ea9c35ec10 100644
--- a/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
+++ b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
@@ -41,6 +41,7 @@ tags:
   analytic_story:
   - Ingress Tool Transfer
   - DarkSide Ransomware
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 100
   context:
diff --git a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
index 3a1547b905..2b8dbd75bc 100644
--- a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
+++ b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
@@ -39,6 +39,7 @@ references:
 tags:
   analytic_story:
   - BITS Jobs
+  - Living Off The Land
   automated_detection_testing: passed
   cis20: []
   confidence: 70
diff --git a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
index 7299d8c16a..3e6e6e5f52 100644
--- a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
+++ b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml
@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Living Off The Land
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
   kill_chain_phases:

From 25c0e67f5c0a21958ddcc14ba906859391eb1b5c Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 2 Mar 2022 12:13:51 -0800
Subject: [PATCH 16/16] adding ssa_package with risk sev

---
 ...ohibited_applications_spawning_cmd_exe.yml |  18 ++-
 .../ssa___windows_bits_job_persistence.yml    | 106 +++++++++++++++++
 .../ssa___windows_bitsadmin_download_file.yml | 110 ++++++++++++++++++
 .../ssa___windows_certutil_decode_file.yml    | 106 +++++++++++++++++
 ...a___windows_certutil_urlcache_download.yml | 101 ++++++++++++++++
 ...___windows_certutil_verifyctl_download.yml | 102 ++++++++++++++++
 ...a___windows_diskshadow_proxy_execution.yml |  99 ++++++++++++++++
 .../srs/ssa___windows_eventvwr_uac_bypass.yml |  99 ++++++++++++++++
 ..._windows_powershell_start-bitstransfer.yml | 103 ++++++++++++++++
 .../ssa___windows_rasautou_dll_execution.yml  | 101 ++++++++++++++++
 10 files changed, 935 insertions(+), 10 deletions(-)
 create mode 100644 dist/ssa/srs/ssa___windows_bits_job_persistence.yml
 create mode 100644 dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml
 create mode 100644 dist/ssa/srs/ssa___windows_certutil_decode_file.yml
 create mode 100644 dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml
 create mode 100644 dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml
 create mode 100644 dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml
 create mode 100644 dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml
 create mode 100644 dist/ssa/srs/ssa___windows_powershell_start-bitstransfer.yml
 create mode 100644 dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml

diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
index 45c1a2f14a..9be3a7d033 100644
--- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
@@ -20,20 +20,18 @@ references:
 risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
   on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
   that warrants investigating.
-search: '| from read_ssa_enriched_events()
-
-  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
-  | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
-  parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
-  null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event,
-  "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
-  "string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null)
-  | where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"),
+  "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"),
+  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string",
+  null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
+  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,"event_id"),
+  "string", null) | where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
   | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe"
   OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
   OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
   OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
-  AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%patch1-Hotfix1a%"))))
+  AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)patch1-Hotfix1a/)=false)))
   OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
   IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml
new file mode 100644
index 0000000000..174f8227ff
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml
@@ -0,0 +1,106 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-15'
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
+  The query identifies the parameters used to create, resume or add a file to a BITS
+  job. Typically seen combined in a oneliner or ran in sequence. If identified, review
+  the BITS job created and capture any files written to disk. It is possible for BITS
+  to be used to upload files and this may require further network data analysis to
+  identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 1e25e97a-8ea4-11ec-9767-acde48001122
+known_false_positives: Limited false positives will be present. Typically, applications
+  will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
+  (legitimate applications) or parent process.
+name: Windows Bits Job Persistence
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1197/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
+- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line,
+  "%setnotifyflags%") OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line,
+  "%setminretrydelay%") OR like (cmd_line, "%setcustomheaders%") OR like (cmd_line,
+  "%resume%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - BITS Jobs
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
+  mitre_attack_id:
+  - T1197
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 56
+  risk_severity: medium
+  security_domain: endpoint
+test:
+  name: Windows Bits Job Persistence Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+      file_name: bits-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_bits_job_persistence.yml
+    name: Windows Bits Job Persistence
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1
diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml
new file mode 100644
index 0000000000..8f504a9a0b
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml
@@ -0,0 +1,110 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
+  object. In addition, look for `download` or `upload` on the command-line, the switches
+  are not required to perform a transfer. Capture any files downloaded. Review the
+  reputation of the IP or domain used. Typically once executed, a follow on command
+  will be used to execute the dropped file. Note that the network connection or file
+  modification events related will not spawn or create from `bitsadmin.exe`, but the
+  artifacts will appear in a parallel process of `svchost.exe` with a command-line
+  similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel
+  and child processes to capture any behaviors and artifacts. In some suspicious and
+  malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
+  to list out the jobs during investigation.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: d76e8188-8f5a-11ec-ace4-acde48001122
+known_false_positives: Limited false positives, however it may be required to filter
+  based on parent process name or network connection.
+name: Windows Bitsadmin Download File
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
+- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
+- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
+- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
+  "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - BITS Jobs
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: Windows Bitsadmin Download File Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+      file_name: bits-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_bitsadmin_download_file.yml
+    name: Windows Bitsadmin Download File
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1
diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml
new file mode 100644
index 0000000000..b1d9df05f7
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml
@@ -0,0 +1,106 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
+  and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
+  and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
+  file that was downloaded. Once decoded, it will be loaded by a parallel process.
+  Note that there are two additional command switches that may be used - `encodehex`
+  and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
+  further execution. During triage, identify the source of the file being decoded.
+  Review its contents or execution behavior for further analysis.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: b06983f4-8f72-11ec-ab50-acde48001122
+known_false_positives: Typically seen used to `encode` files, but it is possible to
+  see legitimate use of `decode`. Filter based on parent-child relationship, file
+  paths, endpoint or user.
+name: Windows CertUtil Decode File
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1140/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
+- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file
+  on disk.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%decode%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
+  "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Deobfuscate-Decode Files or Information
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/ master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file
+    on disk.
+  mitre_attack_id:
+  - T1140
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 40
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: Windows CertUtil Decode File Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_certutil_decode_file.yml
+    name: Windows CertUtil Decode File
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1
diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml
new file mode 100644
index 0000000000..02ae17f5a1
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml
@@ -0,0 +1,101 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: Certutil.exe may download a file from a remote destination using `-urlcache`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
+  During triage, capture any files on disk and review. Review the reputation of the
+  remote IP or domain in question.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 8cb1ad38-8f6d-11ec-87a3-acde48001122
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+name: Windows CertUtil URLCache Download
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
+  "%urlcache%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows CertUtil URLCache Download Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+      file_name: T1105-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_certutil_urlcache_download.yml
+    name: Windows CertUtil URLCache Download
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1
diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml
new file mode 100644
index 0000000000..78fbe31f70
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml
@@ -0,0 +1,102 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  \ During triage, capture any files on disk and review. Review the reputation of
+  the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
+  written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 9ac29c40-8f6b-11ec-b19a-acde48001122
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+name: Windows CertUtil VerifyCtl Download
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
+  "%verifyctl%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows CertUtil VerifyCtl Download  Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+      file_name: T1105-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_certutil_verifyctl_download_.yml
+    name: Windows CertUtil VerifyCtl Download
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1
diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml
new file mode 100644
index 0000000000..fd1496d2c7
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml
@@ -0,0 +1,99 @@
+author: Lou Stella, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-17'
+description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server.
+  It has a scripting mode intended for complex scripted backup operations. This feature
+  also allows for execution of arbitrary unsigned code. This analytic looks for the
+  usage of the scripting mode flags in executions of DiskShadow. During triage, compare
+  to known backup behavior in your environment and then review the scripts called
+  by diskshadow.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on processes that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+id: aa502688-9037-11ec-842d-acde48001122
+known_false_positives: Administrators using the DiskShadow tool in their infrastructure
+  as a main backup tool with scripts will cause false positives
+name: Windows Diskshadow Proxy Execution
+product:
+- Splunk Behavioral Analytics
+references:
+- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event,
+  "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="diskshadow.exe"
+  AND (like (cmd_line, "%-s%") OR like (cmd_line, "%/s%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
+  mitre_attack_id:
+  - T1218
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: BA Windows Diskshadow Proxy Execution Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_diskshadow_proxy_execution.yml
+    name: BA Windows Diskshadow Proxy Execution
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 1
diff --git a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml
new file mode 100644
index 0000000000..9956dd4fa7
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml
@@ -0,0 +1,99 @@
+author: Lou Stella, Splunk
+datamodel:
+- Endpoint_Registry
+date: '2022-02-18'
+description: The following search identifies Eventvwr bypass by identifying the registry
+  modification into a specific path that eventvwr.msc looks to (but is not valid)
+  upon execution. A successful attack will include a suspicious command to be executed
+  upon eventvwr.msc loading. Upon triage, review the parallel processes that have
+  executed. Identify any additional registry modifications on the endpoint that may
+  look suspicious. Remediate as necessary.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Registry` datamodel.
+id: 66adff66-90d9-11ec-aba7-acde48001122
+known_false_positives: None known at this time.
+name: Windows Eventvwr UAC Bypass
+product:
+- Splunk Behavioral Analytics
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://attack.mitre.org/techniques/T1548/002
+- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
+risk_message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)),
+  registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)),
+  registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string",
+  null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"),
+  "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"),
+  "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"),
+  "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"),
+  "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive",
+  registry_hive, "registry_value_name", registry_value_name, "registry_key_name",
+  registry_key_name, "registry_value_type", registry_value_type, "registry_value_data",
+  registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - IcedID
+  - Living Off The Land
+  cis20:
+  - CIS 14
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+  impact: 80
+  kill_chain_phases:
+  - Privilege Escalation
+  message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  nist:
+  - DE.AE
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - event_id
+  - registry_path
+  - registry_hive
+  - registry_value_name
+  - registry_key_name
+  - registry_value_type
+  - registry_value_data
+  - process_guid
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows Eventvwr UAC Bypass Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+      file_name: windows-sysmon-registry.log
+      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+      sourcetype: xmlwineventlog
+    file: endpoint/ssa___windows_eventvwr_uac_bypass.yml
+    name: Windows Eventvwr UAC Bypass
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 1
diff --git a/dist/ssa/srs/ssa___windows_powershell_start-bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start-bitstransfer.yml
new file mode 100644
index 0000000000..b15826348a
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_powershell_start-bitstransfer.yml
@@ -0,0 +1,103 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar
+  functionality is present. This technique variation is not as commonly used by adversaries,
+  but has been abused in the past. Lesser known uses include the ability to set the
+  `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload`
+  is used, it is highly possible files will be archived. During triage, review parallel
+  processes and process lineage. Capture any files on disk and review. For the remote
+  domain or IP, what is the reputation?
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+id: 0bafd086-8f61-11ec-996e-acde48001122
+known_false_positives: Limited false positives. It is possible administrators will
+  utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
+  process or command-line arguments.
+name: Windows PowerShell Start-BitsTransfer
+product:
+- Splunk Behavioral Analytics
+references:
+- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
+- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
+  (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - BITS Jobs
+  - Living Off The Land
+  automated_detection_testing: passed
+  cis20: []
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: Windows PowerShell Start-BitsTransfer Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
+      file_name: T1197_windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_powershell_start_bitstransfer.yml
+    name: Windows PowerShell Start-BitsTransfer
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1
diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml
new file mode 100644
index 0000000000..54080ee24b
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml
@@ -0,0 +1,101 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-15'
+description: The following analytic identifies the Windows Windows Remote Auto Dialer,
+  rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary
+  shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review
+  parent and child process behavior including file and image loads.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 6f42b8ce-1e15-11ec-ad5a-acde48001122
+known_false_positives: False positives will be limited to applications that require
+  Rasautou.exe to load a DLL from disk. Filter as needed.
+name: Windows Rasautou DLL Execution
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/mandiant/DueDLLigence
+- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
+- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513
+- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe"
+  AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Living Off The Land
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+  mitre_attack_id:
+  - T1055.001
+  - T1218
+  - T1055
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows Rasautou DLL Execution Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_rasautou_dll_execution.yml
+    name: Windows Rasautou DLL Execution
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1