Merge branch 'develop' into uac_bypass

detections/cloud/aws_createaccesskey.yml

@@ -10,9 +10,9 @@ description: This search looks for AWS CloudTrail events where a user A who has
   user B. Attackers have been know to use this technique for Privilege Escalation
   in case new victim(user B) has more permissions than old victim(user B)
 search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com
-  errorCode = success| search userIdentity.userName!=requestParameters.userName  |  stats count
-  min(_time) as firstTime max(_time) as lastTime  by requestParameters.userName src
-  eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
+  errorCode = success| search userIdentity.userName!=requestParameters.userName  |  stats
+  count min(_time) as firstTime max(_time) as lastTime  by requestParameters.userName
+  src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
   user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.

detections/cloud/aws_createloginprofile.yml

@@ -10,12 +10,13 @@ description: This search looks for AWS CloudTrail events where a user A(victim A
   B from the same src_ip as user B. This correlated event can be indicative of privilege
   escalation since both events happened from the same src_ip
 search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName
-  as new_login_profile | table src_ip eventName new_login_profile userIdentity.userName  | join
-  new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin | rename
-  userIdentity.userName  as new_login_profile | stats count values(eventName) min(_time) as firstTime
-  max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID
-  awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`] | `aws_createloginprofile_filter`'
+  as new_login_profile | table src_ip eventName new_login_profile userIdentity.userName  |
+  join new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin |
+  rename userIdentity.userName  as new_login_profile | stats count values(eventName)
+  min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode
+  userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile
+  src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`]
+  | `aws_createloginprofile_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible

detections/cloud/aws_updateloginprofile.yml

@@ -10,9 +10,9 @@ description: This search looks for AWS CloudTrail events where a user A who has
   another user B . Attackers have been know to use this technique for Privilege Escalation
   in case new victim(user B) has more permissions than old victim(user B)
 search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com
-  errorCode = success| search userIdentity.userName!=requestParameters.userName  |  stats count
-  min(_time) as firstTime max(_time) as lastTime  by requestParameters.userName src
-  eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName
+  errorCode = success| search userIdentity.userName!=requestParameters.userName  |  stats
+  count min(_time) as firstTime max(_time) as lastTime  by requestParameters.userName
+  src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName
   user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.

detections/cloud/detect_new_open_s3_buckets.yml

@@ -13,8 +13,8 @@ search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex
   | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers")
   | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") |
   rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime
-  max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission
-  bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent
+  uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `detect_new_open_s3_buckets_filter` '
 how_to_implement: You must install the AWS App for Splunk.
 known_false_positives: While this search has no known false positives, it is possible

detections/endpoint/account_discovery_with_net_app.yml

@@ -33,12 +33,31 @@ tags:
   analytic_story:
   - Trickbot
   automated_detection_testing: passed
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
+  impact: 10
   kill_chain_phases:
   - Reconnaissance
+  message: Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1087.002
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: process_name
+    type: Process Name
+    role:
+    - Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -53,25 +72,5 @@ tags:
   - Processes.process_guid
   - Processes.dest
   - Processes.user
-  security_domain: endpoint
-  impact: 10
-  confidence: 50
-  # (impact * confidence)/100
   risk_score: 5
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  message: Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: process_name
-    type: Process Name
-    role:
-    - Process
+  security_domain: endpoint

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -8,8 +8,8 @@ datamodel:
 - Endpoint
 description: This analytic detects a potential suspicious modification of firewall
   rule registry allowing inbound traffic in specific port with public profile. This
-  technique was identified when an adversary wants to grant remote access to a machine by
-  allowing the traffic in a firewall rule.
+  technique was identified when an adversary wants to grant remote access to a machine
+  by allowing the traffic in a firewall rule.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
   Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name =
@@ -29,12 +29,28 @@ tags:
   analytic_story:
   - Prohibited Traffic Allowed or Protocol Mismatch
   automated_detection_testing: passed
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log
+  impact: 10
   kill_chain_phases:
   - Exploitation
+  message: Suspicious firewall modifications were detected via the registry on endpoint
+    $dest$ by user $user$.
   mitre_attack_id:
   - T1021.001
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -46,21 +62,5 @@ tags:
   - Registry.registry_key_name
   - Registry.dest
   - Registry.user
-  security_domain: endpoint
-  impact: 10
-  confidence: 30
-  # (impact * confidence)/100
   risk_score: 3
-  context:
-  - Source:Endpoint
-  - Stage:Lateral Movement
-  message: Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$. 
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml

@@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic identifies suspicious PowerShell command to allow inbound
-  traffic inbound to a specific local port within the public profile. This technique was seen in some
-  attacker want to have a remote access to a machine by allowing the traffic in firewall
-  rule.
+description: The following analytic identifies suspicious PowerShell command to allow
+  inbound traffic inbound to a specific local port within the public profile. This
+  technique was seen in some attacker want to have a remote access to a machine by
+  allowing the traffic in firewall rule.
 search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message
   = "*Inbound*" Message = "*Allow*"  Message = "*-LocalPort*" | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
@@ -25,12 +25,28 @@ tags:
   analytic_story:
   - Prohibited Traffic Allowed or Protocol Mismatch
   automated_detection_testing: passed
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log
+  impact: 10
   kill_chain_phases:
   - Exploitation
+  message: Suspicious firewall modification detected on endpoint $ComputerName$ by
+    user $user$.
   mitre_attack_id:
   - T1021.001
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -41,21 +57,5 @@ tags:
   - Message
   - ComputerName
   - User
-  security_domain: endpoint
-  impact: 10
-  confidence: 30
-  # (impact * confidence)/100
   risk_score: 3
-  context:
-  - Source:Endpoint
-  - Stage:Lateral Movement
-  message: Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: ComputerName
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/allow_network_discovery_in_firewall.yml

@@ -48,7 +48,7 @@ tags:
   - Processes.process_name
   - Processes.process
   - Processes.process_id
-  - Processes.parent_process  
+  - Processes.parent_process
   - Processes.parent_process_id
   - Processes.parent_process_name
   security_domain: endpoint

detections/endpoint/allow_operation_with_consent_admin.yml

@@ -31,12 +31,28 @@ tags:
   analytic_story:
   - Ransomware
   automated_detection_testing: passed
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
+  impact: 50
   kill_chain_phases:
   - Exploitation
+  message: Suspicious registry modification was performed on endpoint $dest$ by user
+    $user$. This behavior is indicative of privilege escalation.
   mitre_attack_id:
   - T1548
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -47,21 +63,5 @@ tags:
   - Registry.registry_key_name
   - Registry.registry_value_name
   - Registry.dest
-  security_domain: endpoint
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
-  context:
-  - Source:Endpoint
-  - Stage:Privilege Escalation
-  message: Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/anomalous_usage_of_7zip.yml

@@ -33,36 +33,20 @@ tags:
   - Cobalt Strike
   - NOBELIUM Group
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
-  kill_chain_phases:
-  - Actions on Objective
-  mitre_attack_id:
-  - T1560.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.parent_process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
   confidence: 80
-  # (impact * confidence)/100
-  risk_score: 64
   context:
   - Source:Endpoint
   - Stage:Collection
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. 
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objective
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading
+    of 7zip.
+  mitre_attack_id:
+  - T1560.001
   observable:
   - name: user
     type: User
@@ -79,4 +63,21 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/any_powershell_downloadfile.yml

@@ -32,36 +32,20 @@ tags:
   analytic_story:
   - Malicious PowerShell
   - Ingress Tool Transfer
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1059.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.parent_process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
   confidence: 70
-  # (impact * confidence)/100
-  risk_score: 56
   context:
   - Source:Endpoint
   - Stage:Exploitation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile
+    within PowerShell.
+  mitre_attack_id:
+  - T1059.001
   observable:
   - name: user
     type: User
@@ -78,4 +62,21 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint

detections/endpoint/any_powershell_downloadstring.yml

@@ -34,33 +34,17 @@ tags:
   - HAFNIUM Group
   - Ingress Tool Transfer
   automated_detection_testing: passed
+  confidence: 70
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString
+    within PowerShell.
   mitre_attack_id:
   - T1059.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.parent_process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 70
-  # (impact * confidence)/100
-  risk_score: 56
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell.
   observable:
   - name: user
     type: User
@@ -77,4 +61,21 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint

detections/endpoint/attacker_tools_on_endpoint.yml

@@ -34,12 +34,21 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 2
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Exploitation
+  - Stage:Recon
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Installation
   - Command and Control
   - Actions on Objectives
+  message: An attacker tool $process_name$,listed in attacker_tools.csv is executed
+    on host $dest$ by User $user$. This process $process_name$ is known to do- $description$
   mitre_attack_id:
   - T1036.005
   - T1595
@@ -47,29 +56,6 @@ tags:
   nist:
   - ID.AM
   - PR.DS
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.process_name
-  - Processes.parent_process
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log
-  security_domain: endpoint
-  impact: 80
-  confidence: 80
-  # (impact * confidence)/100
-  risk_score: 64
-  context:
-  - Source:Endpoint
-  - Stage:Exploitation
-  - Stage:Recon
-  - Stage:Execution
-  message: An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$
   observable:
   - name: user
     type: User
@@ -88,3 +74,14 @@ tags:
     role:
     - Child Process
     - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml

@@ -9,9 +9,10 @@ datamodel:
 description: Attempt To Add Certificate To Untrusted Store
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
   as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil*
-  (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.process_name
-    Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`'
+  (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
+  | `attempt_to_add_certificate_to_untrusted_store_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
@@ -20,8 +21,8 @@ how_to_implement: You must be ingesting data that records process activity from
 known_false_positives: There may be legitimate reasons for administrators to add a
   certificate to the untrusted certificate store. In such cases, this will typically
   be done on a large number of systems.
-references: 
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
 tags:
   analytic_story:
   - Disabling Security Tools
@@ -31,40 +32,24 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 8
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Installation
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    attempting to add a certificate to the store on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1553.004
   nist:
   - PR.PT
   - DE.CM
   - PR.IP
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 70
-  confidence: 50
-  # (impact * confidence)/100
-  risk_score: 35
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$.
   observable:
   - name: user
     type: User
@@ -81,4 +66,20 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 35
+  security_domain: endpoint

detections/endpoint/attempt_to_stop_security_service.yml

@@ -12,10 +12,10 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where (Processes.process_name = net.exe OR  Processes.process_name = sc.exe) Processes.process="*
   stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  |lookup security_services_lookup service as process OUTPUTNEW category, description
-  | search category=security | `attempt_to_stop_security_service_filter`'
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup
+  security_services_lookup service as process OUTPUTNEW category, description | search
+  category=security | `attempt_to_stop_security_service_filter`'
 how_to_implement: You must be ingesting data that records the file-system activity
   from your hosts to populate the Endpoint file-system data-model node. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
@@ -28,8 +28,8 @@ how_to_implement: You must be ingesting data that records the file-system activi
   services you would like to monitor for attempts to stop the service.,
 known_false_positives: None identified. Attempts to disable security-related services
   should be identified and understood.
-references: 
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
 tags:
   analytic_story:
   - Disabling Security Tools
@@ -40,39 +40,24 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 8
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log
+  impact: 40
   kill_chain_phases:
   - Installation
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    attempting to disable security services on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1562.001
   nist:
   - PR.PT
   - DE.CM
   - PR.IP
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 40
-  confidence: 50
-  # (impact * confidence)/100
-  risk_score: 20
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$.
   observable:
   - name: user
     type: User
@@ -89,4 +74,19 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 20
+  security_domain: endpoint

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -13,16 +13,16 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
   OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*
   OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*)
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `attempted_credential_dump_from_registry_via_reg_exe_filter`'
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
   field in the Endpoint data model.
 known_false_positives: None identified.
-references: 
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
 tags:
   analytic_story:
   - Credential Dumping
@@ -33,36 +33,21 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
+  impact: 90
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to export the registry keys.
   mitre_attack_id:
   - T1003.002
   nist:
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 90
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. 
   observable:
   - name: user
     type: User
@@ -79,4 +64,19 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/batch_file_write_to_system32.yml

@@ -33,34 +33,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Delivery
+  message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$
+    by user $user$.
   mitre_attack_id:
   - T1204.002
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Filesystem.dest
-  - Filesystem.file_name
-  - Filesystem.user
-  - Filesystem.file_path
-  security_domain: endpoint
-  impact: 70
-  confidence: 90
-  # (impact * confidence)/100
-  risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Execution
-  message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$.
   observable:
   - name: user
     type: User
@@ -73,4 +61,16 @@ tags:
   - name: file_name
     type: File Name
     role:
-    - Victim
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.dest
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
+  risk_score: 63
+  security_domain: endpoint

detections/endpoint/bcdedit_failure_recovery_modification.yml

@@ -20,7 +20,7 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi
   data model in the Processes node. Tune based on parent process names.
 known_false_positives: Administrators may modify the boot configuration.
 references:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
 tags:
   analytic_story:
   - Ryuk Ransomware
@@ -29,34 +29,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Impact
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+  impact: 100
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting disable the ability to recover the
+    endpoint.
   mitre_attack_id:
   - T1490
   nist:
   - PR.IP
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
-  security_domain: endpoint
-  impact: 100
-  confidence: 80
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Impact
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint.
   observable:
   - name: user
     type: User
@@ -73,4 +61,17 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/bits_job_persistence.yml

@@ -35,38 +35,19 @@ tags:
   analytic_story:
   - BITS Jobs
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1197
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 70
   confidence: 80
-  # (impact * confidence)/100
-  risk_score: 56
   context:
   - Source:Endpoint
   - Stage:Persistence
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to persist using BITS.
+  mitre_attack_id:
+  - T1197
   observable:
   - name: user
     type: User
@@ -83,4 +64,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint

detections/endpoint/bitsadmin_download_file.yml

@@ -40,39 +40,20 @@ tags:
   - BITS Jobs
   - DarkSide Ransomware
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1197
-  - T1105
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 70
   confidence: 70
-  # (impact * confidence)/100
-  risk_score: 49
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
   observable:
   - name: user
     type: User
@@ -89,4 +70,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml

@@ -33,38 +33,19 @@ tags:
   - Ingress Tool Transfer
   - DarkSide Ransomware
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1105
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
   confidence: 100
-  # (impact * confidence)/100
-  risk_score: 90
   context:
   - Source:Endpoint
   - Stage:Command and Control
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
   observable:
   - name: user
     type: User
@@ -81,4 +62,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml

@@ -34,38 +34,19 @@ tags:
   - Ingress Tool Transfer
   - DarkSide Ransomware
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1105
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
   confidence: 100
-  # (impact * confidence)/100
-  risk_score: 90
   context:
   - Source:Endpoint
   - Stage:Command and Control
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
   observable:
   - name: user
     type: User
@@ -82,4 +63,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/certutil_exe_certificate_extraction.yml

@@ -11,9 +11,10 @@ description: This search looks for arguments to certutil.exe indicating the mani
   tokens specially inside Federated environments such as Windows ADFS.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
   as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
-  Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`'
+  Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id|
+  `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
+  | `certutil_exe_certificate_extraction_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -27,36 +28,17 @@ tags:
   - Cloud Federated Credential Abuse
   asset_type: Endpoint
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log
-  kill_chain_phases:
-  - Installation
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
   confidence: 70
-  # (impact * confidence)/100
-  risk_score: 63
   context:
   - Source:Endpoint
   - Stage:Privilege Escalation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Installation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting export a certificate.
   observable:
   - name: user
     type: User
@@ -73,4 +55,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 63
+  security_domain: endpoint

detections/endpoint/certutil_with_decode_argument.yml

@@ -35,38 +35,19 @@ tags:
   analytic_story:
   - Deobfuscate-Decode Files or Information
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1140
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 50
   confidence: 80
-  # (impact * confidence)/100
-  risk_score: 40
   context:
   - Source:Endpoint
   - Stage:Execution
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to decode a file.
+  mitre_attack_id:
+  - T1140
   observable:
   - name: user
     type: User
@@ -83,4 +64,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 40
+  security_domain: endpoint

detections/endpoint/clear_unallocated_sector_using_cipher_app.yml

@@ -20,44 +20,26 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
 known_false_positives: administrator may execute this app to manage disk
 references:
-  - https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
-  - https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
+- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
+- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
 tags:
   analytic_story:
   - Ransomware
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1070.004
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 100
   confidence: 90
-  # (impact * confidence)/100
-  risk_score: 90
   context:
   - Source:Endpoint
   - Stage:Impact
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors
+    of a specific disk.
+  mitre_attack_id:
+  - T1070.004
   observable:
   - name: user
     type: User
@@ -75,3 +57,22 @@ tags:
     type: Process
     role:
     - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/clop_common_exec_parameter.yml

@@ -18,7 +18,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process
   = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
-    Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -31,38 +31,20 @@ tags:
   analytic_story:
   - Clop Ransomware
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_b/windows-sysmon.log
-  kill_chain_phases:
-  - Obfuscation
-  mitre_attack_id:
-  - T1204
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 100
   confidence: 100
-  # (impact * confidence)/100
-  risk_score: 100
   context:
   - Source:Endpoint
   - Stage:Execution
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_b/windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Obfuscation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting using arguments to execute its main
+    code or feature of its code related to Clop ransomware.
+  mitre_attack_id:
+  - T1204
   observable:
   - name: user
     type: User
@@ -79,4 +61,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 100
+  security_domain: endpoint

detections/endpoint/clop_ransomware_known_service_name.yml

@@ -25,33 +25,19 @@ tags:
   analytic_story:
   - Clop Ransomware
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log
-  kill_chain_phases:
-  - Privilege Escalation
-  mitre_attack_id:
-  - T1543
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - EventCode
-  - cmdline
-  - _time
-  - parent_process_name
-  - process_name
-  - OriginalFileName
-  - process_path
-  security_domain: endpoint
-  impact: 100
   confidence: 100
-  # (impact * confidence)/100
-  risk_score: 100
   context:
   - Source:Endpoint
   - Stage:Privilege Escalation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log
+  impact: 100
+  kill_chain_phases:
+  - Privilege Escalation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ executing known Clop Ransomware service names.
+  mitre_attack_id:
+  - T1543
   observable:
   - name: user
     type: User
@@ -68,4 +54,18 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - EventCode
+  - cmdline
+  - _time
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  risk_score: 100
+  security_domain: endpoint

detections/endpoint/cmd_echo_pipe___escalation.yml

@@ -28,40 +28,22 @@ tags:
   analytic_story:
   - Cobalt Strike
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  - Privilege Escalation
-  mitre_attack_id:
-  - T1059.003
-  - T1543.003
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
   confidence: 80
-  # (impact * confidence)/100
-  risk_score: 64
   context:
   - Source:Endpoint
   - Stage:Privilege Escalation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ potentially performing privilege escalation
+    using named pipes related to Cobalt Strike and other frameworks.
+  mitre_attack_id:
+  - T1059.003
+  - T1543.003
   observable:
   - name: user
     type: User
@@ -78,4 +60,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml

@@ -26,12 +26,32 @@ tags:
   - DarkSide Ransomware
   - Ransomware
   automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Exploitation
+  message: The following module $ImageLoaded$ was loaded by a non-standard application
+    on endpoint $Computer$ by user $user$.
   mitre_attack_id:
   - T1218.003
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: ImageLoaded
+    type: Other
+    role:
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -45,25 +65,5 @@ tags:
   - EventCode
   - Signed
   - ProcessId
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: Computer
-    type: Hostname
-    role:
-    - Victim
-  - name: ImageLoaded
-    type: Other
-    role:
-    - Other
+  security_domain: endpoint

detections/endpoint/cobalt_strike_named_pipes.yml

@@ -46,36 +46,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $process_name$ was identified on endpoint $Computer$ by
+    user $user$ accessing known suspicious named pipes related to Cobalt Strike.
   mitre_attack_id:
   - T1055
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventID
-  - PipeName
-  - Computer
-  - process_name
-  - process_path
-  - process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 90
-  # (impact * confidence)/100
-  risk_score: 72
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike.
   observable:
   - name: user
     type: User
@@ -88,4 +74,18 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Parent Process
+    - Parent Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - PipeName
+  - Computer
+  - process_name
+  - process_path
+  - process_id
+  risk_score: 72
+  security_domain: endpoint

detections/endpoint/common_ransomware_extensions.yml

@@ -36,6 +36,7 @@ known_false_positives: It is possible for a legitimate file with these extension
   of files created with these extensions.
 references: []
 tags:
+  Consequence: Data Destruction
   analytic_story:
   - SamSam Ransomware
   - Ryuk Ransomware
@@ -45,35 +46,23 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_extensions/windows-sysmon.log
+  impact: 90
   kill_chain_phases:
   - Actions on Objectives
+  message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$,
+    this is indicative of a known ransomware file extension and should be reviewed
+    immediately.
   mitre_attack_id:
   - T1485
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Filesystem.user
-  - Filesystem.dest
-  - Filesystem.file_path
-  - Filesystem.file_name
-  security_domain: endpoint
-  impact: 90
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 90
-  context:
-  - Source:Endpoint
-  - Stage:Execution
-  Consequence: Data Destruction
-  message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately.
   observable:
   - name: user
     type: User
@@ -86,4 +75,16 @@ tags:
   - name: file_name
     type: File Name
     role:
-    - Victim
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/common_ransomware_notes.yml

@@ -22,6 +22,7 @@ known_false_positives: It's possible that a legitimate file could be created wit
   the same name used by ransomware note files.
 references: []
 tags:
+  Consequence: Data Destruction
   analytic_story:
   - SamSam Ransomware
   - Ransomware
@@ -31,35 +32,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/windows-sysmon.log
+  impact: 90
   kill_chain_phases:
   - Actions on Objectives
+  message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$,
+    this is indicative of a known ransomware note file and should be reviewed immediately.
   mitre_attack_id:
   - T1485
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Filesystem.user
-  - Filesystem.dest
-  - Filesystem.file_path
-  - Filesystem.file_name
-  security_domain: endpoint
-  impact: 90
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 90
-  context:
-  - Source:Endpoint
-  - Stage:Execution
-  Consequence: Data Destruction
-  message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately.
   observable:
   - name: user
     type: User
@@ -72,4 +60,16 @@ tags:
   - name: file_name
     type: File Name
     role:
-    - Victim
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/conti_common_exec_parameter.yml

@@ -28,38 +28,20 @@ tags:
   analytic_story:
   - Ransomware
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1204
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
   confidence: 80
-  # (impact * confidence)/100
-  risk_score: 64
   context:
   - Source:Endpoint
   - Stage:Execution
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ executing specific Conti Ransomware related
+    parameters.
+  mitre_attack_id:
+  - T1204
   observable:
   - name: user
     type: User
@@ -76,4 +58,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -29,43 +29,25 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
+  impact: 50
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators
+    group.
   mitre_attack_id:
   - T1136.001
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 50
-  confidence: 60
-  # (impact * confidence)/100
-  risk_score: 30
-  context:
-  - Source:Endpoint
-  - Stage:Persistence
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group.
   observable:
   - name: user
     type: User
@@ -82,4 +64,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 30
+  security_domain: endpoint

detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml

@@ -30,41 +30,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon.log
+  impact: 50
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ enumerating Windows file shares.
   mitre_attack_id:
   - T1070.005
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
-  risk_score: 25
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares.
   observable:
   - name: user
     type: User
@@ -81,4 +62,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 25
+  security_domain: endpoint

detections/endpoint/create_remote_thread_into_lsass.yml

@@ -28,14 +28,30 @@ tags:
   cis20:
   - CIS 8
   - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  impact: 90
   kill_chain_phases:
   - Actions on Objectives
+  message: A process has created a remote thread into $TargetImage$ on $dest$. This
+    behavior is indicative of credential dumping and should be investigated.
   mitre_attack_id:
   - T1003.001
   nist:
   - DE.CM
+  observable:
+  - name: TargetImage
+    type: Other
+    role:
+    - Other
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -49,21 +65,5 @@ tags:
   - TargetImage
   - TargetProcessId
   - dest
-  security_domain: endpoint
-  impact: 90
-  confidence: 90
-  # (impact * confidence)/100
   risk_score: 81
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated.
-  observable:
-  - name: TargetImage
-    type: Other
-    role:
-    - Other
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/create_service_in_suspicious_file_path.yml

@@ -24,12 +24,28 @@ tags:
   analytic_story:
   - Clop Ransomware
   automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log
+  impact: 70
   kill_chain_phases:
   - Privilege Escalation
+  message: A service $Service_File_Name$ was created from a non-standard path using
+    $Service_Name$, potentially leading to a privilege escalation.
   mitre_attack_id:
   - T1569.002
+  observable:
+  - name: Service_File_Name
+    type: Other
+    role:
+    - Other
+  - name: Service_Name
+    type: Other
+    role:
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -41,21 +57,5 @@ tags:
   - _time
   - Service_Name
   - Service_Start_Type
-  security_domain: endpoint
-  impact: 70
-  confidence: 80
-  # (impact * confidence)/100
   risk_score: 56
-  context:
-  - Source:Endpoint
-  - Stage:Privilege Escalation
-  message: A service $Service_File_Name$ was created from a non-standard path using $Service_Name$, potentially leading to a privilege escalation.
-  observable:
-  - name: Service_File_Name
-    type: Other
-    role:
-    - Other
-  - name: Service_Name
-    type: Other
-    role:
-    - Other
+  security_domain: endpoint

detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml

@@ -34,34 +34,21 @@ tags:
   cis20:
   - CIS 6
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$
+    to disk. This behavior is related to dumping credentials via Task Manager.
   mitre_attack_id:
   - T1003.001
   nist:
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventID
-  - process_name
-  - TargetFilename
-  - Computer
-  - object_category
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager.
   observable:
   - name: user
     type: User
@@ -78,4 +65,17 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - process_name
+  - TargetFilename
+  - Computer
+  - object_category
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/creation_of_shadow_copy.yml

@@ -31,40 +31,22 @@ tags:
   cis20:
   - CIS 8
   - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+  impact: 90
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform
+    offline password cracking.
   mitre_attack_id:
   - T1003.003
   nist:
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
-  confidence: 90
-  # (impact * confidence)/100
-  risk_score: 81
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
   observable:
   - name: user
     type: User
@@ -82,3 +64,22 @@ tags:
     type: Process
     role:
     - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml

@@ -27,40 +27,22 @@ tags:
   cis20:
   - CIS 8
   - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+  impact: 90
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform
+    offline password cracking.
   mitre_attack_id:
   - T1003.003
   nist:
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
-  confidence: 90
-  # (impact * confidence)/100
-  risk_score: 81
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
   observable:
   - name: user
     type: User
@@ -77,4 +59,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml

@@ -30,40 +30,22 @@ tags:
   cis20:
   - CIS 8
   - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+  impact: 90
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline
+    password cracking.
   mitre_attack_id:
   - T1003.003
   nist:
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
-  confidence: 90
-  # (impact * confidence)/100
-  risk_score: 81
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking.
   observable:
   - name: user
     type: User
@@ -80,4 +62,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml

@@ -28,40 +28,22 @@ tags:
   cis20:
   - CIS 8
   - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+  impact: 90
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy
+    to grab credentials.
   mitre_attack_id:
   - T1003.003
   nist:
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
-  confidence: 90
-  # (impact * confidence)/100
-  risk_score: 81
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials.
   observable:
   - name: user
     type: User
@@ -78,4 +60,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/delete_shadowcopy_with_powershell.yml

@@ -28,12 +28,28 @@ tags:
   - Ransomware
   - Revil Ransomware
   automated_detection_testing: passed
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log
+  impact: 90
   kill_chain_phases:
   - Exploitation
+  message: An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$
+    by $User$.
   mitre_attack_id:
   - T1490
+  observable:
+  - name: User
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -44,21 +60,5 @@ tags:
   - Message
   - ComputerName
   - User
-  security_domain: endpoint
-  impact: 90
-  confidence: 90
-  # (impact * confidence)/100
   risk_score: 81
-  context:
-  - Source:Endpoint
-  - Stage:Execution
-  message: An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$.
-  observable:
-  - name: User
-    type: User
-    role:
-    - Victim
-  - name: ComputerName
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/deleting_of_net_users.yml

@@ -31,38 +31,19 @@ tags:
   analytic_story:
   - XMRig
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1531
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 50
   confidence: 50
-  # (impact * confidence)/100
-  risk_score: 25
   context:
   - Source:Endpoint
   - Stage:Persistence
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to delete accounts.
+  mitre_attack_id:
+  - T1531
   observable:
   - name: user
     type: User
@@ -79,4 +60,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 25
+  security_domain: endpoint

detections/endpoint/deleting_shadow_copies.yml

@@ -35,42 +35,23 @@ tags:
   cis20:
   - CIS 8
   - CIS 10
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+  impact: 90
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to delete shadow copies.
   mitre_attack_id:
   - T1490
   nist:
   - PR.PT
   - DE.CM
   - PR.IP
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
-  confidence: 90
-  # (impact * confidence)/100
-  risk_score: 81
-  context:
-  - Source:Endpoint
-  - Stage:Execution
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies.
   observable:
   - name: user
     type: User
@@ -87,4 +68,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml

@@ -26,10 +26,17 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/atomic_red_team/windows-security.log
+  impact: 70
   kill_chain_phases:
   - Actions on Objectives
+  message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type
+    3, which may be indicative of the pass the hash technique.
   mitre_attack_id:
   - T1550.002
   nist:
@@ -37,27 +44,6 @@ tags:
   - PR.AT
   - PR.AC
   - PR.IP
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventCode
-  - Logon_Type
-  - Logon_Process
-  - WorkstationName
-  - user
-  - dest
-  security_domain: access
-  impact: 70
-  confidence: 70
-  # (impact * confidence)/100
-  risk_score: 49
-  context:
-  - Source:Endpoint
-  - Stage:Lateral Movement
-  message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique.
   observable:
   - name: user
     type: User
@@ -70,4 +56,18 @@ tags:
   - name: EventCode
     type: Other
     role:
-    - Other
+    - Other
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Logon_Type
+  - Logon_Process
+  - WorkstationName
+  - user
+  - dest
+  risk_score: 49
+  security_domain: access

detections/endpoint/detect_azurehound_command_line_arguments.yml

@@ -29,42 +29,23 @@ tags:
   analytic_story:
   - Discovery Techniques
   automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Reconnaissance
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD.
   mitre_attack_id:
   - T1087.002
   - T1087.001
   - T1482
   - T1069.002
   - T1069.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD.
   observable:
   - name: user
     type: User
@@ -81,4 +62,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/detect_azurehound_file_modifications.yml

@@ -32,36 +32,23 @@ tags:
   analytic_story:
   - Discovery Techniques
   automated_detection_testing: passed
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Reconnaissance
+  message: A file - $file_name$ was written to disk that is related to AzureHound,
+    a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1087.002
   - T1087.001
   - T1482
   - T1069.002
   - T1069.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - file_path
-  - dest
-  - file_name
-  - process_id
-  - file_create_time
-  security_domain: endpoint
-  impact: 70
-  confidence: 90
-  # (impact * confidence)/100
-  risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  message: A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$.
   observable:
   - name: user
     type: User
@@ -74,4 +61,17 @@ tags:
   - name: file_name
     type: File Name
     role:
-    - Victim
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - file_path
+  - dest
+  - file_name
+  - process_id
+  - file_create_time
+  risk_score: 63
+  security_domain: endpoint

detections/endpoint/detect_computer_changed_with_anonymous_account.yml

@@ -26,33 +26,21 @@ tags:
   cis20:
   - CIS 6
   - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  impact: 70
   kill_chain_phases:
   - Actions on Objectives
+  message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type
+    3, which may be indicative of the an account or group being changed by an anonymous
+    account.
   mitre_attack_id:
   - T1210
   nist:
   - DE.AE
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventCode
-  - TargetUserName
-  - LogonType
-  - TargetDomainName
-  - user
-  security_domain: endpoint
-  impact: 70
-  confidence: 70
-  # (impact * confidence)/100
-  risk_score: 49
-  context:
-  - Source:Endpoint
-  - Stage:Lateral Movement
-  message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account.
   observable:
   - name: user
     type: User
@@ -65,4 +53,17 @@ tags:
   - name: EventCode
     type: Other
     role:
-    - Other
+    - Other
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetUserName
+  - LogonType
+  - TargetDomainName
+  - user
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/detect_credential_dumping_through_lsass_access.yml

@@ -33,16 +33,37 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: The $source_image$ has attempted access to read $TargetImage$ was identified
+    on endpoint $Computer$, this is indicative of credential dumping and should be
+    investigated.
   mitre_attack_id:
   - T1003.001
   nist:
   - PR.IP
   - PR.AC
   - DE.CM
+  observable:
+  - name: source_image
+    type: Other
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: TargetImage
+    type: Other
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -57,25 +78,5 @@ tags:
   - SourceProcessId
   - TargetImage
   - TargetProcessId
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated.
-  observable:
-  - name: source_image
-    type: Other
-    role:
-    - Victim
-  - name: Computer
-    type: Hostname
-    role:
-    - Victim
-  - name: TargetImage
-    type: Other
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/detect_empire_with_powershell_script_block_logging.yml

@@ -39,12 +39,28 @@ tags:
   analytic_story:
   - Malicious PowerShell
   automated_detection_testing: passed
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+  impact: 90
   kill_chain_phases:
   - Exploitation
+  message: The following behavior was identified and typically related to PowerShell-Empire
+    on $ComputerName$ by $User$.
   mitre_attack_id:
   - T1059.001
+  observable:
+  - name: User
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -56,21 +72,5 @@ tags:
   - ComputerName
   - User
   - EventCode
-  security_domain: endpoint
-  impact: 90
-  confidence: 90
-  # (impact * confidence)/100
   risk_score: 81
-  context:
-  - Source:Endpoint
-  - Stage:Execution
-  message: The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$.
-  observable:
-  - name: User
-    type: User
-    role:
-    - Victim
-  - name: ComputerName
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml

@@ -38,13 +38,29 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log
+  impact: 60
+  message: Multiple accounts have been locked out. Review $dest$ and results related
+    to $user$.
   mitre_attack_id:
   - T1078.002
   nist:
   - PR.IP
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -55,21 +71,5 @@ tags:
   - nodename
   - All_Changes.result
   - All_Changes.dest
-  security_domain: access
-  impact: 60
-  confidence: 60
-  # (impact * confidence)/100
   risk_score: 36
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: Multiple accounts have been locked out. Review $dest$ and results related to $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
+  security_domain: access

detections/endpoint/detect_excessive_user_account_lockouts.yml

@@ -27,31 +27,20 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log
+  impact: 60
+  message: Multiple accounts have been locked out. Review $nodename$ and $result$
+    related to $user$.
   mitre_attack_id:
   - T1078.003
   nist:
   - PR.IP
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - All_Changes.result
-  - nodename
-  - All_Changes.user
-  security_domain: access
-  impact: 60
-  confidence: 60
-  # (impact * confidence)/100
-  risk_score: 36
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$.
   observable:
   - name: user
     type: User
@@ -61,3 +50,14 @@ tags:
     type: Other
     role:
     - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.result
+  - nodename
+  - All_Changes.user
+  risk_score: 36
+  security_domain: access

detections/endpoint/detect_exchange_web_shell.yml

@@ -35,32 +35,20 @@ tags:
   analytic_story:
   - HAFNIUM Group
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1505.003
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Filesystem.file_path
-  - Filesystem.process_id
-  - Filesystem.file_name
-  - Filesystem.file_hash
-  - Filesystem.user
-  security_domain: endpoint
-  impact: 90
   confidence: 90
-  # (impact * confidence)/100
-  risk_score: 81
   context:
   - Source:Endpoint
   - Stage:Exploitation
-  message: A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: A file - $file_name$ was written to disk that is related to IIS exploitation
+    previously performed by HAFNIUM. Review further file modifications on endpoint
+    $dest$ by user $user$.
+  mitre_attack_id:
+  - T1505.003
   observable:
   - name: user
     type: User
@@ -73,4 +61,17 @@ tags:
   - name: file_name
     type: File Name
     role:
-    - Victim
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_path
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.file_hash
+  - Filesystem.user
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/detect_html_help_renamed.yml

@@ -37,38 +37,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: The following $process_name$ has been identified as renamed, spawning from
+    $parent_process_name$.
   mitre_attack_id:
   - T1218.001
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventID
-  - OriginalFileName
-  - process_name
-  - Computer
-  - User
-  - parent_process_name
-  - process_path
-  - CommandLine
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. 
   observable:
   - name: user
     type: User
@@ -85,4 +69,20 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - OriginalFileName
+  - process_name
+  - Computer
+  - User
+  - parent_process_name
+  - process_path
+  - CommandLine
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/detect_html_help_spawn_child_process.yml

@@ -40,41 +40,23 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ spawning a child process, typically not normal
+    behavior.
   mitre_attack_id:
   - T1218.001
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior.
   observable:
   - name: user
     type: User
@@ -91,4 +73,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/detect_html_help_url_in_command_line.yml

@@ -42,41 +42,23 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
+  impact: 90
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_proces_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ contacting a remote destination to potentally
+    download a malicious payload.
   mitre_attack_id:
   - T1218.001
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 90
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload.
   observable:
   - name: user
     type: User
@@ -93,4 +75,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml

@@ -44,41 +44,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: $process_name$ has been identified using Infotech Storage Handlers to load
+    a specific file within a CHM on $dest$ under user $user$.
   mitre_attack_id:
   - T1218.001
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 90
-  # (impact * confidence)/100
-  risk_score: 72
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$.
   observable:
   - name: user
     type: User
@@ -91,4 +72,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 72
+  security_domain: endpoint

detections/endpoint/detect_mimikatz_using_loaded_images.yml

@@ -35,35 +35,22 @@ tags:
   cis20:
   - CIS 6
   - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: A process, $Image$, has loaded $ImageLoaded$ that are typically related
+    to credential dumping on $Computer$. Review for further details.
   mitre_attack_id:
   - T1003.001
   nist:
   - DE.AE
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventCode
-  - ImageLoaded
-  - ProcessId
-  - Computer
-  - Image
-  security_domain: endpoint
-  impact: 80
-  confidence: 80
-  # (impact * confidence)/100
-  risk_score: 64
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details.
   observable:
   - name: user
     type: User
@@ -80,4 +67,17 @@ tags:
   - name: Image
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ImageLoaded
+  - ProcessId
+  - Computer
+  - Image
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml

@@ -36,12 +36,28 @@ tags:
   analytic_story:
   - Malicious PowerShell
   automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+  impact: 90
   kill_chain_phases:
   - Exploitation
+  message: The following behavior was identified and typically related to MimiKatz
+    being loaded within the context of PowerShell on $ComputerName$ by $User$.
   mitre_attack_id:
   - T1003
+  observable:
+  - name: User
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -53,21 +69,5 @@ tags:
   - ComputerName
   - User
   - EventCode
-  security_domain: endpoint
-  impact: 90
-  confidence: 100
-  # (impact * confidence)/100
   risk_score: 90
-  context:
-  - Source:Endpoint
-  - Stage:Credential Access
-  message: The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$.
-  observable:
-  - name: User
-    type: User
-    role:
-    - Victim
-  - name: ComputerName
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/detect_mshta_inline_hta_execution.yml

@@ -34,41 +34,23 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  impact: 90
   kill_chain_phases:
   - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense
+    evasion.
   mitre_attack_id:
   - T1218.005
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 90
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 90
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion.
   observable:
   - name: user
     type: User
@@ -85,4 +67,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/detect_mshta_renamed.yml

@@ -31,38 +31,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Exploitation
+  message: The following $process_name$ has been identified as renamed, spawning from
+    $parent_process_name$.
   mitre_attack_id:
   - T1218.005
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventID
-  - OriginalFileName
-  - process_name
-  - Computer
-  - User
-  - parent_process_name
-  - process_path
-  - CommandLine
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. 
   observable:
   - name: user
     type: User
@@ -79,4 +63,20 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - OriginalFileName
+  - process_name
+  - Computer
+  - User
+  - parent_process_name
+  - process_path
+  - CommandLine
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/detect_mshta_url_in_command_line.yml

@@ -35,41 +35,23 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $est$ by user $user$ attempting to access a remote destination to
+    download an additional payload.
   mitre_attack_id:
   - T1218.005
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload.
   observable:
   - name: user
     type: User
@@ -86,4 +68,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/detect_new_local_admin_account.yml

@@ -26,18 +26,34 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
+  impact: 60
   kill_chain_phases:
   - Actions on Objectives
   - Command and Control
+  message: A $user$ on $dest$ was added recently. Identify if this was legitimate
+    behavior or not.
   mitre_attack_id:
   - T1136.001
   nist:
   - PR.AC
   - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -49,21 +65,5 @@ tags:
   - member_id
   - dest
   - user
-  security_domain: access
-  impact: 60
-  confidence: 70
-  # (impact * confidence)/100
   risk_score: 42
-  context:
-  - Source:Endpoint
-  - Stage:Persistence
-  message: A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
+  security_domain: access

detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml

@@ -31,41 +31,23 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to perform privilege escalation by
+    using unquoted service paths.
   mitre_attack_id:
   - T1574.009
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 70
-  confidence: 70
-  # (impact * confidence)/100
-  risk_score: 49
-  context:
-  - Source:Endpoint
-  - Stage:Privilege Escalation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths.
   observable:
   - name: user
     type: User
@@ -82,4 +64,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml

@@ -32,43 +32,25 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 2
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon.log
+  impact: 40
   kill_chain_phases:
   - Installation
   - Command and Control
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning multiple $process_name$ was
+    identified on endpoint $dest$ by user $user$ typically not a normal behavior of
+    the process.
   mitre_attack_id:
   - T1016
   nist:
   - ID.AM
   - PR.DS
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 40
-  confidence: 80
-  # (impact * confidence)/100
-  risk_score: 32
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  message: An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process.
   observable:
   - name: user
     type: User
@@ -85,4 +67,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 32
+  security_domain: endpoint

detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml

@@ -32,41 +32,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ running prohibited applications.
   mitre_attack_id:
   - T1059.003
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Execution
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications.
   observable:
   - name: user
     type: User
@@ -83,4 +64,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -16,8 +16,9 @@ description: This search looks for events where `PsExec.exe` is run with the `ac
   within the command line.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process=*psexec* Processes.process=*accepteula* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`|
+  where Processes.process=*psexec* Processes.process=*accepteula* by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`|
   `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -40,41 +41,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/windows-sysmon.log
+  impact: 50
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ running the utility for possibly the first time.
   mitre_attack_id:
   - T1021.002
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 50
-  confidence: 70
-  # (impact * confidence)/100
-  risk_score: 35
-  context:
-  - Source:Endpoint
-  - Stage:Execution
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time.
   observable:
   - name: user
     type: User
@@ -91,4 +73,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 35
+  security_domain: endpoint

detections/endpoint/detect_rclone_command_line_usage.yml

@@ -34,34 +34,20 @@ tags:
   - DarkSide Ransomware
   - Ransomware
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
-  kill_chain_phases:
-  - Exfiltration
-  mitre_attack_id:
-  - T1020
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 50
   confidence: 70
-  # (impact * confidence)/100
-  risk_score: 35
   context:
   - Source:Endpoint
   - Stage:Exfiltration
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exfiltration
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service
+    to move files or folders.
+  mitre_attack_id:
+  - T1020
   observable:
   - name: user
     type: User
@@ -78,4 +64,19 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 35
+  security_domain: endpoint

detections/endpoint/detect_regasm_spawning_a_process.yml

@@ -37,37 +37,23 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ spawning a child process, typically not normal
+    behavior for $parent_process_name$.
   mitre_attack_id:
   - T1218.009
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 80
-  # (impact * confidence)/100
-  risk_score: 64
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$.
   observable:
   - name: user
     type: User
@@ -84,4 +70,19 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/detect_regasm_with_network_connection.yml

@@ -37,15 +37,35 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $process_name$ contacting a remote destination was identified
+    on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
   mitre_attack_id:
   - T1218.009
   nist:
   - PR.PT
   - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -60,25 +80,5 @@ tags:
   - src_ip
   - dest_host
   - dest_ip
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: Computer
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  security_domain: endpoint

detections/endpoint/detect_regasm_with_no_command_line_arguments.yml

@@ -34,40 +34,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Actions on Objectives
+  message: The process $process_name$ was spawned by $parent_image$ without any command-line
+    arguments on $dest$ by $user$.
   mitre_attack_id:
   - T1218.009
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventID
-  - process_name
-  - OriginalFileName
-  - CommandLine
-  - dest
-  - User
-  - ParentImage
-  - ParentCommandLine
-  - process_path
-  - Computer
-  security_domain: endpoint
-  impact: 70
-  confidence: 70
-  # (impact * confidence)/100
-  risk_score: 49
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$.
   observable:
   - name: user
     type: User
@@ -85,3 +67,21 @@ tags:
     type: Process
     role:
     - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - process_name
+  - OriginalFileName
+  - CommandLine
+  - dest
+  - User
+  - ParentImage
+  - ParentCommandLine
+  - process_path
+  - Computer
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/detect_regsvcs_spawning_a_process.yml

@@ -36,38 +36,22 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$  was identified
+    on endpoint $dest$ by user $user$ typically not normal for this process.
   mitre_attack_id:
   - T1218.009
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 80
-  # (impact * confidence)/100
-  risk_score: 64
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$  was identified on endpoint $dest$ by user $user$ typically not normal for this process.
   observable:
   - name: user
     type: User
@@ -84,4 +68,20 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/detect_regsvcs_with_network_connection.yml

@@ -37,15 +37,35 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $process_name$ contacting a remote destination was identified
+    on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
   mitre_attack_id:
   - T1218.009
   nist:
   - PR.PT
   - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -59,25 +79,5 @@ tags:
   - User
   - src_ip
   - dest_host
-  security_domain: Endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: Computer
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  security_domain: Endpoint

detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml

@@ -34,15 +34,39 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Actions on Objectives
+  message: The process $process_name$ was spawned by $parent_image$ without any command-line
+    arguments on $dest$ by $user$.
   mitre_attack_id:
   - T1218.009
   nist:
   - PR.PT
   - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_image
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -60,29 +84,5 @@ tags:
   - OriginalFileName
   - process_path
   - Computer
-  security_domain: endpoint
-  impact: 70
-  confidence: 70
-  # (impact * confidence)/100
   risk_score: 49
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_image
-    type: Parent Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  security_domain: endpoint

detections/endpoint/detect_regsvr32_application_control_bypass.yml

@@ -42,40 +42,22 @@ tags:
   cis20:
   - CIS 8
   - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ in an attempt
+    to bypass detection and preventative controls was identified on endpoint $dest$
+    by user $user$.
   mitre_attack_id:
   - T1218.010
   nist:
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$.
   observable:
   - name: user
     type: User
@@ -92,4 +74,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/detect_renamed_7_zip.yml

@@ -26,35 +26,19 @@ tags:
   analytic_story:
   - Collection and Staging
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
-  kill_chain_phases:
-  - Exfiltration
-  mitre_attack_id:
-  - T1560.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - User
-  - parent_process_name
-  - process_name
-  - OriginalFileName
-  - process_path
-  - CommandLine
-  - Product
-  security_domain: endpoint
-  impact: 30
   confidence: 90
-  # (impact * confidence)/100
-  risk_score: 27
   context:
   - Source:Endpoint
   - Stage:Collection
-  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. 
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exfiltration
+  message: The following $process_name$ has been identified as renamed, spawning from
+    $parent_process_name$ on $dest$ by $user$.
+  mitre_attack_id:
+  - T1560.001
   observable:
   - name: user
     type: User
@@ -71,4 +55,20 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - User
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  - CommandLine
+  - Product
+  risk_score: 27
+  security_domain: endpoint

detections/endpoint/detect_renamed_psexec.yml

@@ -34,37 +34,21 @@ tags:
   - DarkSide Ransomware
   - Lateral Movement
   automated_detection_testing: passed
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Collection
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
+  impact: 30
   kill_chain_phases:
   - Exploitation
   - Lateral Movement
   - Execution
+  message: The following $process_name$ has been identified as renamed, spawning from
+    $parent_process_name$ on $dest$ by $user$.
   mitre_attack_id:
   - T1569.002
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - User
-  - parent_process_name
-  - process_name
-  - OriginalFileName
-  - process_path
-  - CommandLine
-  - Product
-  security_domain: endpoint
-  impact: 30
-  confidence: 90
-  # (impact * confidence)/100
-  risk_score: 27
-  context:
-  - Source:Endpoint
-  - Stage:Collection
-  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. 
   observable:
   - name: user
     type: User
@@ -81,4 +65,20 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - User
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  - CommandLine
+  - Product
+  risk_score: 27
+  security_domain: endpoint

detections/endpoint/detect_renamed_rclone.yml

@@ -32,32 +32,19 @@ tags:
   - DarkSide Ransomware
   - Ransomware
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
-  kill_chain_phases:
-  - Exfiltration
-  mitre_attack_id:
-  - T1020
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - OriginalFileName
-  - process_name
-  - process_path
-  - CommandLine
-  - dest
-  security_domain: endpoint
-  impact: 30
   confidence: 90
-  # (impact * confidence)/100
-  risk_score: 27
   context:
   - Source:Endpoint
   - Stage:Collection
-  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. 
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exfiltration
+  message: The following $process_name$ has been identified as renamed, spawning from
+    $parent_process_name$ on $dest$ by $user$.
+  mitre_attack_id:
+  - T1020
   observable:
   - name: user
     type: User
@@ -74,4 +61,17 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - OriginalFileName
+  - process_name
+  - process_path
+  - CommandLine
+  - dest
+  risk_score: 27
+  security_domain: endpoint

detections/endpoint/detect_renamed_winrar.yml

@@ -29,36 +29,20 @@ tags:
   analytic_story:
   - Collection and Staging
   automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  - Exfiltration
-  mitre_attack_id:
-  - T1560.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - User
-  - parent_process_name
-  - process_name
-  - OriginalFileName
-  - process_path
-  - CommandLine
-  - Product
-  security_domain: endpoint
-  impact: 30
   confidence: 90
-  # (impact * confidence)/100
-  risk_score: 27
   context:
   - Source:Endpoint
   - Stage:Collection
-  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. 
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  - Exfiltration
+  message: The following $process_name$ has been identified as renamed, spawning from
+    $parent_process_name$ on $dest$ by $user$.
+  mitre_attack_id:
+  - T1560.001
   observable:
   - name: user
     type: User
@@ -75,4 +59,20 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - User
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  - CommandLine
+  - Product
+  risk_score: 27
+  security_domain: endpoint

detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

@@ -17,9 +17,10 @@ description: The following analytic identifies rundll32.exe loading advpack.dll
   It's possible other files are on disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter`'
+  Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_rundll32_application_control_bypass___advpack_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -38,37 +39,23 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll
+    and ieadvpack.dll by calling the LaunchINFSection function on the command line
+    was identified on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1218.011
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
   observable:
   - name: user
     type: User
@@ -85,4 +72,19 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml

@@ -17,9 +17,10 @@ description: The following analytic identifies rundll32.exe loading setupapi.dll
   It's possible other files are on disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter`'
+  Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_rundll32_application_control_bypass___setupapi_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -38,37 +39,23 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll
+    and iesetupapi.dll by calling the LaunchINFSection function on the command line
+    was identified on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1218.011
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
   observable:
   - name: user
     type: User
@@ -85,4 +72,19 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml

@@ -17,9 +17,10 @@ description: The following analytic identifies rundll32.exe loading syssetup.dll
   files are on disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter`'
+  Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_rundll32_application_control_bypass___syssetup_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -38,37 +39,23 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll
+    by calling the LaunchINFSection function on the command line was identified on
+    endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1218.011
   nist:
   - PR.PT
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
   observable:
   - name: user
     type: User
@@ -85,4 +72,19 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/detect_rundll32_inline_hta_execution.yml

@@ -37,15 +37,28 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Execution
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Exploitation
+  message: Suspicious rundll32.exe inline HTA execution on $dest$
   mitre_attack_id:
   - T1218.005
   nist:
   - PR.PT
   - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -58,18 +71,5 @@ tags:
   - Processes.dest
   - Processes.parent_process_name
   - Processes.parent_process
-  security_domain: endpoint
-  impact: 70
-  confidence: 80
   risk_score: 56
-  context:
-  - Source:Endpoint
-  - Stage:Initial Access
-  - Stage:Execution
-  - Stage:Defense Evasion
-  message: Suspicious rundll32.exe inline HTA execution on $dest$
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/detect_sharphound_command_line_arguments.yml

@@ -33,16 +33,27 @@ tags:
   - Discovery Techniques
   - Ransomware
   automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+  impact: 30
   kill_chain_phases:
   - Reconnaissance
+  message: Possible SharpHound command-Line arguments identified on $dest$
   mitre_attack_id:
   - T1087.002
   - T1087.001
   - T1482
   - T1069.002
   - T1069.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -56,16 +67,5 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 30
-  confidence: 80
   risk_score: 24
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  message: Possible SharpHound command-Line arguments identified on $dest$
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/detect_sharphound_file_modifications.yml

@@ -43,16 +43,31 @@ tags:
   - Discovery Techniques
   - Ransomware
   automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+  impact: 30
   kill_chain_phases:
   - Reconnaissance
+  message: Potential SharpHound file modifications identified on $dest$
   mitre_attack_id:
   - T1087.002
   - T1087.001
   - T1482
   - T1069.002
   - T1069.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -64,20 +79,5 @@ tags:
   - file_name
   - process_id
   - file_create_time
-  security_domain: endpoint
-  impact: 30
-  confidence: 80
   risk_score: 24
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  message: Potential SharpHound file modifications identified on $dest$
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: User
-    type: User
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/detect_sharphound_usage.yml

@@ -36,16 +36,27 @@ tags:
   - Discovery Techniques
   - Ransomware
   automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+  impact: 30
   kill_chain_phases:
   - Reconnaissance
+  message: Potential SharpHound binary identified on $dest$
   mitre_attack_id:
   - T1087.002
   - T1087.001
   - T1482
   - T1069.002
   - T1069.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -60,16 +71,5 @@ tags:
   - process_path
   - CommandLine
   - Product
-  security_domain: endpoint
-  impact: 30
-  confidence: 80
   risk_score: 24
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  message: Potential SharpHound binary identified on $dest$
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml

@@ -30,15 +30,28 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 8
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Execution
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Exploitation
+  message: cmd.exe launching script interpreters on $dest$
   mitre_attack_id:
   - T1059.003
   nist:
   - PR.PT
   - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -51,18 +64,5 @@ tags:
   - Processes.parent_process
   - Processes.user
   - Processes.dest
-  security_domain: endpoint
-  impact: 70
-  confidence: 50
   risk_score: 35
-  context:
-  - Source:Endpoint
-  - Stage:Initial Access
-  - Stage:Execution
-  - Stage:Defense Evasion
-  message: cmd.exe launching script interpreters on $dest$
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/detect_wmi_event_subscription_persistence.yml

@@ -44,12 +44,24 @@ tags:
   analytic_story:
   - Suspicious WMI Use
   automated_detection_testing: passed
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Exploitation
+  message: Possible malicious WMI Subscription created on $dest$
   mitre_attack_id:
   - T1546.003
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -59,17 +71,5 @@ tags:
   - Destination
   - Computer
   - User
-  security_domain: endpoint
-  impact: 70
-  confidence: 90
   risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Persistence
-  - Stage:Privilege Escalation
-  message: Possible malicious WMI Subscription created on $dest$
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/disable_logs_using_wevtutil.yml

@@ -27,12 +27,23 @@ tags:
   analytic_story:
   - Ransomware
   automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source: Endpoint
+  - Stage: Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
+  impact: 30
   kill_chain_phases:
   - Exploitation
+  message: WevtUtil.exe used to disable Event Logging on $dest
   mitre_attack_id:
   - T1070.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -47,16 +58,5 @@ tags:
   - Processes.user
   - Processes.process_id
   - Processes.process_guid
-  security_domain: endpoint
-  impact: 30
-  confidence: 80
   risk_score: 24
-  context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
-  message: WevtUtil.exe used to disable Event Logging on $dest
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/disable_registry_tool.yml

@@ -6,11 +6,11 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search identifies modification of registry to disable the
-  regedit or registry tools of the windows operating system. Since registry tool is a
-  swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this
-  application to prevent the removal of their registry entry such as persistence,
-  file less components and defense evasion.
+description: This search identifies modification of registry to disable the regedit
+  or registry tools of the windows operating system. Since registry tool is a swiss
+  knife in analyzing registry, malware such as RAT or trojan Spy disable this application
+  to prevent the removal of their registry entry such as persistence, file less components
+  and defense evasion.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
   Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
@@ -27,12 +27,18 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source: Endpoint
+  - Stage: Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+  impact: 40
   kill_chain_phases:
   - Exploitation
+  message: Disabled Registry Tools
   mitre_attack_id:
   - T1562.001
   product:
@@ -46,11 +52,5 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  security_domain: endpoint
-  impact: 40
-  confidence: 100
   risk_score: 40
-  context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
-  message: Disabled Registry Tools
+  security_domain: endpoint

detections/endpoint/disable_show_hidden_files.yml

@@ -6,10 +6,10 @@ author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic is to identify a modification in the Windows registry to prevent
-  users from seeing all the files with hidden attributes. This event or techniques are
-  known on some worm and trojan spy malware that will drop hidden files on the infected
-  machine.
+description: The following analytic is to identify a modification in the Windows registry
+  to prevent users from seeing all the files with hidden attributes. This event or
+  techniques are known on some worm and trojan spy malware that will drop hidden files
+  on the infected machine.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
   OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt"
@@ -29,12 +29,18 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source: Endpoint
+  - Stage: Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+  impact: 40
   kill_chain_phases:
   - Exploitation
+  message: Disabled 'Show Hidden Files'
   mitre_attack_id:
   - T1564.001
   - T1562.001
@@ -49,11 +55,5 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_nam
-  security_domain: endpoint
-  impact: 40
-  confidence: 100
   risk_score: 40
-  context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
-  message: Disabled 'Show Hidden Files'
+  security_domain: endpoint

detections/endpoint/disable_windows_app_hotkeys.yml

@@ -31,10 +31,16 @@ tags:
   analytic_story:
   - XMRig
   automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source: Endpoint
+  - Stage: Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log
+  impact: 40
   kill_chain_phases:
   - Exploitation
+  message: Disabled 'Windows App Hotkeys'
   mitre_attack_id:
   - T1562.001
   product:
@@ -47,11 +53,5 @@ tags:
   - Registry.registry_path
   - Registry.registry_value_name
   - Registry.dest Registry.user
-  security_domain: endpoint
-  impact: 40
-  confidence: 100
   risk_score: 40
-  context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
-  message: Disabled 'Windows App Hotkeys'
+  security_domain: endpoint

detections/endpoint/disable_windows_behavior_monitoring.yml

@@ -35,14 +35,25 @@ tags:
   - Ransomware
   - Revil Ransomware
   automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source: Endpoint
+  - Stage: Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+  impact: 40
   kill_chain_phases:
   - Exploitation
+  message: Windows Defender real time behavior monitoring disabled on $dest
   mitre_attack_id:
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -54,16 +65,5 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  security_domain: endpoint
-  impact: 40
-  confidence: 100
   risk_score: 40
-  context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
-  message: Windows Defender real time behavior monitoring disabled on $dest
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/disable_windows_smartscreen_protection.yml

@@ -27,7 +27,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   automated_detection_testing: passed
-  confidence: 100
+  confidence: 50
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
@@ -35,26 +35,21 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-  impact: 40
+  impact: 50
   kill_chain_phases:
   - Exploitation
-  message: $Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$
-    to disable the smartscreen protection of windows machine
+  message: The Windows Smartscreen was disabled on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
   observable:
-  - name: Registry.dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: Registry.use
+  - name: user
     type: User
     role:
     - Victim
-  - name: Registry.registry_key_name
-    type: Other
+  - name: dest
+    type: Hostname
     role:
-    - Target
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -66,22 +61,5 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_nam
-  risk_score: 40
-  security_domain: endpoint
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: The Windows Smartscreen was disabled on $dest$ by $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/disabling_cmd_application.yml

@@ -26,7 +26,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   automated_detection_testing: passed
-  confidence: 100
+  confidence: 50
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
@@ -34,26 +34,21 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-  impact: 40
+  impact: 50
   kill_chain_phases:
   - Exploitation
-  message: $Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$
-    to disable to disable the cmd prompt application of a windows machine
+  message: The Windows command prompt was disabled on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
   observable:
-  - name: Registry.dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: Registry.user
+  - name: user
     type: User
     role:
     - Victim
-  - name: Registry.registry_key_name
-    type: Other
+  - name: dest
+    type: Hostname
     role:
-    - Target
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -65,22 +60,5 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  risk_score: 40
-  security_domain: endpoint
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: The Windows command prompt was disabled on $dest$ by $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/disabling_controlpanel.yml

@@ -25,7 +25,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   automated_detection_testing: passed
-  confidence: 100
+  confidence: 50
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
@@ -33,26 +33,21 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-  impact: 40
+  impact: 50
   kill_chain_phases:
   - Exploitation
-  message: $Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$
-    to disable to disable the control panel window on a windows machine
+  message: The Windows Control Panel was disabled on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
   observable:
-  - name: Registry.dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: Registry.user
+  - name: user
     type: User
     role:
     - Victim
-  - name: Registry.registry_key_name
-    type: Other
+  - name: dest
+    type: Hostname
     role:
-    - Target
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -64,22 +59,5 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  risk_score: 40
-  security_domain: endpoint
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: The Windows Control Panel was disabled on $dest$ by $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/disabling_firewall_with_netsh.yml

@@ -27,7 +27,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   automated_detection_testing: passed
-  confidence: 100
+  confidence: 50
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
@@ -35,26 +35,21 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-  impact: 40
+  impact: 50
   kill_chain_phases:
   - Exploitation
-  message: $Processes.user$ on $Processes.dest$ used the netsh application in a suspicious
-    manner to disable the firewall
+  message: The Windows Firewall was disabled on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
   observable:
-  - name: Processes.dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: Processes.user
+  - name: user
     type: User
     role:
     - Victim
-  - name: Processes.process
-    type: Process
+  - name: dest
+    type: Hostname
     role:
-    - Target
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -69,22 +64,5 @@ tags:
   - Processes.process_name
   - Processes.process_id
   - Processes.parent_process_id
-  risk_score: 40
-  security_domain: endpoint
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: The Windows Firewall was disabled on $dest$ by $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/disabling_folderoptions_windows_feature.yml

@@ -27,7 +27,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   automated_detection_testing: passed
-  confidence: 100
+  confidence: 50
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
@@ -35,27 +35,21 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
-  impact: 40
+  impact: 50
   kill_chain_phases:
   - Exploitation
-  message: $Registry.user$ on $Registry.dest modified registry key name=$Registry.registry_key_name$
-    to disable the folder options feature of windows to show hidden files, file extensions,
-    etc
+  message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
   observable:
-  - name: Registry.dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: Registry.user
+  - name: user
     type: User
     role:
     - Victim
-  - name: Registry.registry_key_name
-    type: Other
+  - name: dest
+    type: Hostname
     role:
-    - Target
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -67,22 +61,5 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  risk_score: 40
-  security_domain: endpoint
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/disabling_net_user_account.yml

@@ -29,54 +29,19 @@ tags:
   analytic_story:
   - XMRig
   automated_detection_testing: passed
-  confidence: 100
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
-  impact: 40
-  kill_chain_phases:
-  - Exploitation
-  message: $Processes.user$ on $Processes.dest$ used a suspicious command ($Processes.process_name$)
-    that disabled a user account using the net.exe utility native to Windows
-  mitre_attack_id:
-  - T1531
-  observable:
-  - name: Processes.dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: Processes.user
-    type: User
-    role:
-    - Victim
-  - name: Processes.process_name
-    type: Process
-    role:
-    - Target
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.process_name
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_id
-  - Processes.parent_process
-  risk_score: 40
-  security_domain: endpoint
-  impact: 70
   confidence: 60
-  # (impact * confidence)/100
-  risk_score: 42
   context:
   - Source:Endpoint
   - Stage:Persistence
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    disabling a user account on endpoint $dest$ by user $user$.
+  mitre_attack_id:
+  - T1531
   observable:
   - name: user
     type: User
@@ -93,4 +58,18 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_id
+  - Processes.parent_process
+  risk_score: 42
+  security_domain: endpoint