Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm

detections/endpoint/suspicious_rundll32_dllregisterserver.yml

@@ -14,12 +14,16 @@ description: The following analytic identifies rundll32.exe using dllregisterser
   parrellel processes executing. Capture the DLL being loaded and inspect further.
   Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
-  Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*dllregisterserver*
+  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_rundll32_dllregisterserver_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: This is likely to produce false positives and will require
   some filtering. Tune the query by adding command line paths to known good DLLs,
   or filtering based on parent process names.
@@ -72,11 +76,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

detections/endpoint/suspicious_rundll32_rename.yml

@@ -4,20 +4,25 @@ version: 3
 date: '2021-02-04'
 author: Michael Haag, Splunk
 type: Hunting
-datamodel: 
+datamodel:
 - Endpoint
 description: The following analytic identifies renamed instances of rundll32.exe executing.
   rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During
   investigation, validate it is the legitimate rundll32.exe executing and what script
-  content it is loading. This query relies on the original filename or
-  internal name from the PE meta data. Expand the query as needed by looking for specific
-  command line arguments outlined in other analytics.
+  content it is loading. This query relies on the original filename or internal name
+  from the PE meta data. Expand the query as needed by looking for specific command
+  line arguments outlined in other analytics.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_rundll32_rename_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id Processes.original_file_name |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `suspicious_rundll32_rename_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:
@@ -67,11 +72,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path