From e39b2ff3b9d1f80069bf560aa4bfacf7dd9dcfd5 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-87-115>
Date: Tue, 7 Sep 2021 12:40:43 +0000
Subject: [PATCH] Added detection testing service results inBcdedit Command
 Back To Normal Mode Boot

---
 ...dedit_command_back_to_normal_mode_boot.yml | 41 ++++++++++---------
 1 file changed, 21 insertions(+), 20 deletions(-)

diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
index 545daa939f..7373e931ba 100644
--- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
@@ -6,25 +6,25 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration.
-  This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using
-  bcdedit deletevalue command. 
-  This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal.
+description: This search is to detect a suspicious bcdedit commandline to configure
+  the host from safe mode back to normal boot configuration. This technique was seen
+  in blackMatter ransomware where it force the compromised host to boot in safe mode
+  to continue its encryption and bring back to normal boot using bcdedit deletevalue
+  command. This TTP can be a good alert for host that booted from safe mode forcefully
+  since it need to modify the boot configuration to bring it back to normal.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
-  Processes.process="*/deletevalue*" Processes.process="*{current}*"  Processes.process="*safeboot*" by Processes.process_name
-  Processes.process Processes.parent_process_name Processes.dest Processes.user 
-  |`drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `bcdedit_command_back_to_normal_mode_boot_filter`'
+  Processes.process="*/deletevalue*" Processes.process="*{current}*"  Processes.process="*safeboot*"
+  by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
+  Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 known_false_positives: unknown
 references:
--  https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 tags:
   analytic_story:
   - BlackMatter Ransomware
@@ -41,20 +41,20 @@ tags:
   required_fields:
   - _time
   - Processes.process_name
-  - Processes.process 
+  - Processes.process
   - Processes.parent_process_name
-  - Processes.parent_process 
-  - Processes.dest 
-  - Processes.user 
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
   impact: 50
   confidence: 70
-  # (impact * confidence)/100
   risk_score: 35
   context:
-    - Source:Endpoint
-    - Stage:Impact
-  message: bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$
+  - Source:Endpoint
+  - Stage:Impact
+  message: bcdedit process with commandline $process$ to bring back to normal boot
+    configuration the $dest$
   observable:
   - name: user
     type: User
@@ -63,4 +63,5 @@ tags:
   - name: dest
     type: Hostname
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed