version and date update

detections/attrib_to_hide_files.yml

@@ -95,7 +95,7 @@ mappings:
     - Persistence
   nist:
     - DE.CM
-modification_date: '2018-11-15'
+modification_date: '2020-03-16'
 name: Hiding Files And Directories With Attrib.exe
 original_authors:
   - company: Splunk
@@ -105,4 +105,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'

detections/change_file_association.yml

@@ -108,7 +108,7 @@ mappings:
     - DE.CM
     - PR.PT
     - PR.IP
-modification_date: '2018-01-26'
+modification_date: '2020-03-16'
 name: Suspicious Changes to File Associations
 original_authors:
   - company: Splunk
@@ -118,4 +118,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'

detections/children_of_spoolsv.yml

@@ -99,7 +99,7 @@ mappings:
     - PR.AC
     - PR.PT
     - DE.CM
-modification_date: '2020-07-03'
+modification_date: '2020-03-16'
 name: Child Processes of Spoolsv.exe
 original_authors:
   - company: Splunk
@@ -109,4 +109,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'

detections/common_ransomware_extensions.yml

@@ -110,7 +110,7 @@ mappings:
   nist:
     - PR.PT
     - DE.CM
-modification_date: '2018-11-15'
+modification_date: '2020-03-16'
 name: Common Ransomware Extensions
 original_authors:
   - company: Splunk
@@ -120,4 +120,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'

detections/common_ransomware_notes.yml

@@ -98,7 +98,7 @@ mappings:
   nist:
     - PR.PT
     - DE.CM
-modification_date: '2018-11-15'
+modification_date: '2020-03-16'
 name: Common Ransomware Notes
 original_authors:
   - company: Splunk
@@ -108,4 +108,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'

detections/create_local_admin_via_net.yml

@@ -98,7 +98,7 @@ mappings:
   nist:
     - PR.PT
     - DE.CM
-modification_date: '2018-11-15'
+modification_date: '2020-03-16'
 name: Create local admin accounts using net.exe
 original_authors:
   - company: Splunk
@@ -108,4 +108,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'

detections/dragonfly_schtasks.yml

@@ -96,7 +96,7 @@ mappings:
     - Scheduled Task
   nist:
     - PR.IP
-modification_date: '2018-12-03'
+modification_date: '2020-03-16'
 name: Scheduled Task Name Used by Dragonfly Threat Actors
 original_authors:
   - company: Splunk
@@ -106,4 +106,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'

detections/file_write_spikes.yml

@@ -96,7 +96,7 @@ mappings:
     - Execution
   nist:
     - DE.CM
-modification_date: '2018-12-03'
+modification_date: '2020-03-16'
 name: Spike in File Writes
 original_authors:
   - company: Splunk
@@ -106,4 +106,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'

detections/lnk_executing_a_process.yml

@@ -81,7 +81,7 @@ mappings:
   nist:
     - ID.AM
     - PR.DS
-modification_date: '2019-04-29'
+modification_date: '2020-03-16'
 name: Suspicious LNK file launching a process
 original_authors:
   - company: Splunk
@@ -91,4 +91,4 @@ responses: []
 security_domain: network
 spec_version: 2
 type: splunk
-version: '1.0'
+version: '2.0'

detections/outlook_writing_zip.yml

@@ -89,7 +89,7 @@ mappings:
   nist:
     - ID.AM
     - PR.DS
-modification_date: '2019-04-29'
+modification_date: '2020-03-16'
 name: Detect Oulook.exe writing a .zip file
 original_authors:
   - company: Splunk
@@ -99,4 +99,4 @@ responses: []
 security_domain: network
 spec_version: 2
 type: splunk
-version: '1.0'
+version: '2.0'

detections/rare_executables_on_endpoint.yml

@@ -111,7 +111,7 @@ mappings:
     - PR.PT
     - PR.DS
     - DE.CM
-modification_date: '2018-10-30'
+modification_date: '2020-03-16'
 name: Detect Rare Executables
 original_authors:
   - company: Splunk
@@ -121,4 +121,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '4.0'
+version: '5.0'

detections/suspicious_reg_process.yml

@@ -104,7 +104,7 @@ mappings:
     - Disabling Security Tools
   nist:
     - DE.CM
-modification_date: '2019-03-01'
+modification_date: '2020-03-16'
 name: Suspicious Reg.exe Process
 original_authors:
   - company: Splunk
@@ -115,4 +115,4 @@ references:
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'

detections/uncommon_processes.yml

@@ -99,7 +99,7 @@ mappings:
   nist:
     - ID.AM
     - PR.DS
-modification_date: '2019-04-01'
+modification_date: '2020-03-16'
 name: Uncommon Processes On Endpoint
 original_authors:
   - company: Splunk
@@ -109,4 +109,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'

detections/unusually_long_commandlines.yml

@@ -99,7 +99,7 @@ mappings:
   nist:
     - PR.PT
     - DE.CM
-modification_date: '2019-02-28'
+modification_date: '2020-03-16'
 name: Unusually Long Command Line
 original_authors:
   - company: Splunk
@@ -109,4 +109,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '3.0'
+version: '4.0'

detections/wmi_process_launch.yml

@@ -96,7 +96,7 @@ mappings:
     - PR.AT
     - PR.AC
     - PR.IP
-modification_date: '2019-02-28'
+modification_date: '2020-03-16'
 name: Process Execution via WMI
 original_authors:
   - company: Splunk
@@ -106,4 +106,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'

detections/wmi_script_execution.yml

@@ -96,7 +96,7 @@ mappings:
     - PR.AT
     - PR.AC
     - PR.IP
-modification_date: '2019-03-01'
+modification_date: '2020-03-16'
 name: Script Execution via WMI
 original_authors:
   - company: Splunk
@@ -106,4 +106,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'