From d646da8e7019992f9f9345cd06dfe6de790e834e Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 17 Sep 2021 05:48:51 -0600
Subject: [PATCH] Revert "Merge branch 'The-Haag-of-The-Storm' of
 https://github.com/splunk/security_content into The-Haag-of-The-Storm"

This reverts commit f7befe61e66a8a53477c425f17944f31c82c3291, reversing
changes made to 5b301ca9b63ca5b843833fb4667f66fc36dd6e87.
---
 .../endpoint/extract_sam_from_registry.yml    | 26 ++++++++-----------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/extract_sam_from_registry.yml b/detections/endpoint/extract_sam_from_registry.yml
index 0cbe1f6fa5..d9001db991 100644
--- a/detections/endpoint/extract_sam_from_registry.yml
+++ b/detections/endpoint/extract_sam_from_registry.yml
@@ -11,17 +11,13 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
   registry hives for offline credential access attacks. Typically found executed from
   a untrusted process or script. Upon execution, a file will be written to disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_reg` (Processes.process=*save*
-  OR Processes.process=*export*) AND (Processes.process=*sam* OR Processes.process=*system*
-  OR Processes.process=*security*) by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `extract_sam_from_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_reg`
+  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam*
+  OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extract_sam_from_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: It is possible some agent based products will generate false
   positives. Filter as needed.
 references:
@@ -68,11 +64,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path