Branch was auto-updated.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,27 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: "[BUG]"
+labels: bug
+assignees: ''
+
+---
+
+## **If you have a Splunk Support contract, creating a support case for your issue may result in faster resolution.**
+
+
+### **Describe the bug**
+A clear and concise description of what the bug is.
+
+### **Expected behavior**
+A clear and concise description of what you expected to happen.
+
+### **Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+### **App Version:**
+ - ESCU: [e.g. 3.51.0]
+ - Splunk Security Essentials: [e.g. 3.5.0]
+
+### **Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: enhancement
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

README.md

@@ -110,13 +110,15 @@ A complete use case, specifically built to detect, investigate, and respond to a
 We welcome feedback and contributions from the community! Please see our [contributing to the project](https://github.com/splunk/security_content/wiki/Contributing-to-the-Project) for more information on how to get involved.
 
 ## Support 💪
-Please use the [GitHub Issue Tracker](https://github.com/splunk/security_content/issues) to submit bugs or request features.
+If you are a Splunk Enterprise customer with a valid support entitlement contract and have a Splunk-related question, you can open a support case on the https://www.splunk.com/ support portal.
+
+Please use the [GitHub Issue Tracker](https://github.com/splunk/security_content/issues) to submit bugs or feature requests using the templates to the Threat Research team directly.
 
 If you have questions or need support, you can:
 
 * Post a question to [Splunk Answers](http://answers.splunk.com)
 * Join the [#security-research](https://splunk-usergroups.slack.com/archives/C1S5BEF38) room in the [Splunk Slack channel](http://splunk-usergroups.slack.com)
-* If you are a Splunk Enterprise customer with a valid support entitlement contract and have a Splunk-related question, you can also open a support case on the https://www.splunk.com/ support portal
+
 
 
 ## License

bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py

@@ -38,6 +38,7 @@ class DetectionTags(BaseModel):
     observable_str: str = None
     kill_chain_phases_id: list = None
     research_site_url: str = None
+    event_schema: str = None
 
 
     @validator('cis20')

bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py

@@ -35,6 +35,9 @@ class ObjToYmlAdapter(Adapter):
             research_site_url = RESEARCH_SITE_BASE + obj.source + "/" + obj.id + "/"
             obj.tags.research_site_url = research_site_url
 
+            # add ocsf schema tag
+            obj.tags.event_schema = 'cim'
+
             body = FindingReportObject.writeFindingReport(obj)
 
             # remove unncessary fields
@@ -60,7 +63,8 @@ class ObjToYmlAdapter(Adapter):
                                 "risk_score": True,
                                 "security_domain": True,
                                 "required_fields": True,
-                                "research_site_url": True
+                                "research_site_url": True,
+                                "event_schema": True
                             },
                         "test": 
                             {

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml

@@ -54,6 +54,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/
+  event_schema: cim
 test:
   name: Anomalous usage of Archive Tools Unit Test
   tests:

detections/application/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml

@@ -0,0 +1,62 @@
+name: Splunk Data exfiltration from Analytics Workspace using sid query
+id: b6d77c6c-f011-4b03-8650-8f10edb7c4a8
+version: 1
+date: '2022-11-1'
+author: Rod Soto, Eric McGinnis
+type: Hunting
+datamodel: []
+description: This hunting search allows operator to discover attempts to exfiltrate data by
+  executing a prepositioned malicious search ID in Analytic Workspace in Splunk Enterprise
+  versions 8.2.9,8.1.12,9.0.2. The attack is browser-based. It requires the attacker to
+  compel a victim to initiate a request within their browser (phishing).
+  The attacker cannot exploit the vulnerability at will.
+search: '`audit_searches` info=granted search NOT ("audit_searches") 
+  search NOT ("security_content_summariesonly") AND ((search="*mstats*[*]*"
+  AND provenance="N/A") OR (search="*mstats*\\\"*[*]*\\\"*"))| eval warning=if(match(search,"\\\\\""),
+  "POTENTIAL INJECTION STAGING", "POTENTIAL INJECTION EXECUTION") | table search, user, warning, timestamp | `splunk_data_exfiltration_from_analytics_workspace_using_sid_query_filter`'
+how_to_implement: The vulnerability affects only instances with Splunk Web Enabled.  After running this search, please run "Splunk Command and Scripting Interpreter Risky SPL MLTK" to gain more insight into potentially risky commands which could lead to data exfiltration.
+known_false_positives: This search may produce false positives.  This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. Special attention must be paid to "/en-US/app/search/analytics_workspace?sid=[sid]" which is where the malicious code will be inserted to trigger attack at victim.
+references:
+- https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+  - CVE-2022-43566
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1567/splunk/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.txt
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Potential data exfiltration attack using SID query by $user$
+  mitre_attack_id:
+  - T1567
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - action
+  - info
+  - user
+  - search_id
+  - metadata
+  - user
+  - _time
+  risk_score: 25
+  security_domain: endpoint

detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml

@@ -0,0 +1,54 @@
+name: Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature
+id: baa41f09-df48-4375-8991-520beea161be
+version: 1
+date: '2022-10-11'
+author: Rod Soto
+type: Hunting
+datamodel: []
+description: This hunting search provides information on possible exploitation attempts against Splunk Secure Gateway App Mobile Alerts feature in Splunk versions 9.0, 8.2.x, 8.1.x. An authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app. 
+search: '`splunkd_webx` uri_path="/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" sort="notification.created_at:-1" | table  clientip file host method uri_query sort | `splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter`'
+how_to_implement: This search only applies if Splunk Mobile Gateway is deployed in the vulnerable Splunk versions. 
+known_false_positives:  This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. Focus of this search is "uri_path=/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" which is the injection point.
+references:
+- https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities 
+  asset_type: Endpoint 
+  cve:
+  - CVE-2022-43567
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint 
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_rce_via_secure_gateway_splunk_mobile_alerts_feature.txt
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: Possible exploitation attempt from $clientip$
+  mitre_attack_id:
+  - T1210
+  nist:
+  - DE.CM
+  observable:
+  - name: clientip
+    type: IP Address
+    role:
+    - Attacker 
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - uri_path
+  - clientip 
+  - file 
+  - host 
+  - method 
+  - sort 
+  risk_score: 81
+  security_domain: endpoint

detections/application/splunk_reflected_xss_in_the_templates_lists_radio.yml

@@ -0,0 +1,55 @@
+name: Splunk Reflected XSS in the templates lists radio
+id: d532d105-c63f-4049-a8c4-e249127ca425
+version: 1
+date: '2022-10-11'
+author: Rod Soto, Chase Franklin
+type: Hunting
+datamodel: []
+description: Splunk versions below 8.1.12,8.2.9 and 9.0.2 are vulnerable to reflected cross site scripting (XSS). A View allows for a Reflected Cross Site scripting via JavaScript Object Notation (JSON) in a query parameter when ouput_mode=radio. 
+search: '`splunkd_webx` user=admin status=200 uri=*/lists/entities/x/ui/views* uri_query!=null | stats count earliest(_time) as event_time values(status) as status values(clientip) as clientip by index, sourcetype, _time, host, user, uri | `splunk_reflected_xss_in_the_templates_lists_radio_filter`'
+how_to_implement: This vulnerability only affects instances with Splunk Web enabled. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+known_false_positives: This search may produce false positives as it is difficult to pinpoint all possible XSS injection characters in a single search string. Special attention is required to "en-US/list/entities/x/ui/views" which is the vulnerable injection point. 
+references:
+- https://research.splunk.com/stories/splunk_vulnerabilities/ 
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities 
+  asset_type: Endpoint 
+  cve: 
+  - CVE-2022-43568
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint 
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_in_templates_lists_radio.txt
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: Potential XSS exploitation against radio template by $user$
+  mitre_attack_id:
+  - T1189
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker 
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - host
+  - clientip 
+  - status 
+  - user 
+  - uri 
+  - uri_query 
+  - uri_path 
+  risk_score: 25
+  security_domain: endpoint

detections/application/splunk_stored_xss_via_data_model_objectname_field.yml

@@ -0,0 +1,56 @@
+name: Splunk Stored XSS via Data Model objectName field
+id: 062bff76-5f9c-496e-a386-cb1adcf69871
+version: 1
+date: '2022-10-11'
+author: Rod Soto
+type: Hunting
+datamodel: []
+description: Splunk Enterprise versions 8.1.12, 8.2.9, 9.0.2 are vulnerable to persistent cross site scripting via Data Model object name. An authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name Data Model. 
+search: '`splunkd_webx` uri=/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model* uri_query!=null | stats count by _time host status clientip user uri | `splunk_stored_xss_via_data_model_objectname_field_filter`'
+how_to_implement: This vulnerability only affects Splunk Web enabled instances. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+known_false_positives: This search may produce false positives and does not cover exploitation attempts via code obfuscation, focus of search is suspicious requests against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the injection point. 
+references:
+- https://www.splunk.com/en_us/product-security.html
+- https://portswigger.net/web-security/cross-site-scripting/cheat-sheet 
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities 
+  asset_type: Endpoint 
+  cve: 
+  - CVE-2022-43569
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint 
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_stored_xss_via_data_model_objectname_field.txt
+  impact: 50 
+  kill_chain_phases:
+  - Exploitation
+  message: A potential XSS attempt has been detected from $user$
+  mitre_attack_id:
+  - T1189
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker 
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - uri
+  - uri_query 
+  - host 
+  - status 
+  - clientip 
+  - user 
+  - uri_path 
+  risk_score: 25
+  security_domain: endpoint

detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml

@@ -0,0 +1,56 @@
+name: Splunk XSS in Save table dialog header in search page
+id: a974d1ee-ddca-4837-b6ad-d55a8a239c20
+version: 1
+date: '2022-10-11'
+author: Rod Soto
+type: Hunting
+datamodel: []
+description: This is a hunting search to find persistent cross-site scripting XSS code that was included while inputing data in 'Save Table' dialog in Splunk Enterprise (8.1.12,8.2.9,9.0.2). A remote user with "power" Splunk role can store this code that can lead to persistent cross site scripting.
+search: '`splunkda` method=POST  uri=/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model | table _time host status clientip user uri | `splunk_xss_in_save_table_dialog_header_in_search_page_filter`'
+how_to_implement: Watch for POST requests combined with XSS script strings or obfuscation against the injection point /en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model.
+known_false_positives: If host is vulnerable and XSS script strings are inputted they will show up in search. Not all Post requests are malicious as they will show when users create and save dashboards. This search may produce several results with non malicious POST requests. Only affects Splunk Web enabled instances. 
+references:
+- https://www.splunk.com/en_us/product-security.html
+- https://portswigger.net/web-security/cross-site-scripting
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint 
+  cve: 
+  - CVE-2022-43561
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint 
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_in_save_table_dialog_in_search_page.txt
+  impact: 50
+  kill_chain_phases: 
+  - Exploitation 
+  message: Possible XSS exploitation attempt from $clientip$
+  mitre_attack_id:
+  - T1189
+  nist:
+  - DE.CM
+  observable:
+  - name: clientip
+    type: IP Address
+    role:
+    - Attacker 
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - host
+  - _time
+  - status 
+  - clientip 
+  - user 
+  - uri 
+  - method 
+  risk_score: 25
+  security_domain: endpoint

detections/cloud/aws_console_login_failed_during_mfa_challenge.yml

@@ -36,7 +36,10 @@ tags:
   - Exploitation
   message: User $user_name$ failed to pass MFA challenge while logging into console from $src$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1621
+
   nist:
   - DE.CM
   observable:

detections/cloud/aws_credential_access_failed_login.yml

@@ -31,6 +31,9 @@ tags:
   - Exploitation
   message: User $user$ has a login failure from IP $src$
   mitre_attack_id:
+  - T1586
+  - T1586.003
+  - T1110
   - T1110.001
   nist:
   - DE.CM

detections/cloud/aws_credential_access_getpassworddata.yml

@@ -31,7 +31,10 @@ tags:
   - Exploitation
   message: User $user_arn$ is seen to make mulitple `GetPasswordData` API calls to instance ids $instance_ids$ from IP $src_ip$
   mitre_attack_id:
-  - T1552
+  - T1586
+  - T1586.003
+  - T1110
+  - T1110.001
   nist:
   - DE.CM
   observable:

detections/cloud/aws_credential_access_rds_password_reset.yml

@@ -33,7 +33,9 @@ tags:
   - Exploitation
   message: $DB$ password has been reset from IP $sourceIPAddress$
   mitre_attack_id:
-  - T1110.002
+  - T1586
+  - T1586.003
+  - T1110
   nist:
   - DE.CM
   observable:

detections/cloud/aws_multi_factor_authentication_disabled.yml

@@ -37,7 +37,11 @@ tags:
   - Exploitation
   message: User $user_name$ has disabled Multi-Factor authentication for AWS account $aws_account_id$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1621
+  - T1556
+  - T1556.006
   nist:
   - DE.CM
   observable:

detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml

@@ -34,6 +34,8 @@ tags:
   - Exploitation
   message: User $user_name$ is seen to have high number of MFA prompt failures within a short period of time.
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1621
   nist:
   - DE.CM

detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2022-09-27'
 author: Bhavin Patel
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. 
 search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
@@ -35,7 +34,9 @@ tags:
   - Exploitation
   message: Multiple failed console login attempts against users $tried_accounts$ seen from $src_ip$
   mitre_attack_id:
-  - T1003.002
+  - T1110
+  - T1110.003
+  - T1110.004
   nist:
   - DE.CM
   observable:

detections/cloud/aws_successful_single_factor_authentication.yml

@@ -33,6 +33,9 @@ tags:
   - Exploitation
   message: User $user_name$ has successfully logged into an AWS Console without Multi-Factor Authentication from $src$
   mitre_attack_id:
+  - T1586
+  - T1586.003
+  - T1078
   - T1078.004
   nist:
   - DE.CM

detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml

@@ -39,7 +39,11 @@ tags:
   - Exploitation
   message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$
   mitre_attack_id:
-  - T1003.002
+  - T1586
+  - T1586.003
+  - T1110
+  - T1110.003
+  - T1110.004
   nist:
   - DE.CM
   observable:

detections/cloud/azure_active_directory_high_risk_sign_in.yml

@@ -38,6 +38,8 @@ tags:
   - Exploitation
   message: A high risk event was identified by Identify Protection for user $body.properties.userPrincipalName$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1110
   - T1110.003
   nist:

detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml

@@ -37,6 +37,8 @@ tags:
   - Exploitation
   message: User $body.properties.userPrincipalName$ failed to pass MFA challenge
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1078
   - T1078.004
   - T1621

detections/cloud/azure_ad_multi_factor_authentication_disabled.yml

@@ -44,7 +44,10 @@ tags:
   - Actions on Objectives
   message: MFA disabled for User $userPrincipalName$ initiated by $initiatedBy$  
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1556
+  - T1556.006
   nist:
   - DE.CM
   observable:

detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml

@@ -45,6 +45,8 @@ tags:
   - Exploitation
   message: Multiple Failed MFA requests for user $body.properties.userPrincipalName$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1621
   - T1078
   - T1078.004 

detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml

@@ -45,6 +45,8 @@ tags:
   - Exploitation
   message: Source Ip $body.properties.ipAddress$ failed to authenticate with 30 users within 5 minutes.
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1110
   - T1110.003
   nist:

detections/cloud/azure_ad_successful_powershell_authentication.yml

@@ -39,6 +39,8 @@ tags:
   - Exploitation
   message: Successful authentication for user $body.properties.userPrincipalName$ using PowerShell.
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1078
   - T1078.004
   nist:

detections/cloud/azure_ad_successful_single_factor_authentication.yml

@@ -37,6 +37,8 @@ tags:
   - Exploitation
   message: Successful authentication for user $body.properties.userPrincipalName$ without MFA
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1078
   - T1078.004
   nist:

detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml

@@ -53,8 +53,11 @@ tags:
   - Exploitation
   message: Possible Password Spraying attack against Azure AD from source ip $body.properties.ipAddress$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1110
   - T1110.003
+  - T1110.004
   nist:
   - DE.CM
   observable:

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -62,6 +62,8 @@ tags:
   message: User $user$ is logging into the AWS console from City $City$ for the first
     time
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1535
   nist:
   - DE.DP

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -63,6 +63,8 @@ tags:
   message: User $user$ is logging into the AWS console from Country $Country$ for
     the first time
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1535
   nist:
   - DE.DP

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -62,6 +62,8 @@ tags:
   message: User $user$ is logging into the AWS console from Region $Region$ for the
     first time
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1535
   nist:
   - DE.DP

detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml

@@ -35,6 +35,8 @@ tags:
   - Exploitation
   message: User $user$ failed to pass MFA challenge
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1078
   - T1078.004
   - T1621

detections/cloud/gcp_multi_factor_authentication_disabled.yml

@@ -39,6 +39,8 @@ tags:
   - Actions on Objectives
   message: MFA disabled for User $user$ initiated by $actor.email$  
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1556
   nist:
   - DE.CM

detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml

@@ -43,6 +43,8 @@ tags:
   - Exploitation
   message: Multiple Failed MFA requests for user $user$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1621
   - T1078
   - T1078.004 

detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml

@@ -35,7 +35,11 @@ tags:
   - Exploitation
   message: Multiple failed login attempts against users $tried_accounts$ seen from $src_ip$
   mitre_attack_id:
+  - T1586
+  - T1586.003
+  - T1110
   - T1110.003
+  - T1110.004
   nist:
   - DE.CM
   observable:

detections/cloud/gcp_successful_single_factor_authentication.yml

@@ -36,6 +36,8 @@ tags:
   - Exploitation
   message: Successful authentication for user $user$ without MFA
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1078
   - T1078.004
   nist:

detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml

@@ -39,7 +39,11 @@ tags:
   - Exploitation
   message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$
   mitre_attack_id:
+  - T1586
+  - T1586.003
+  - T1110
   - T1110.003
+  - T1110.004
   nist:
   - DE.CM
   observable:

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -39,6 +39,7 @@ tags:
   - Azorult
   - DarkCrystal RAT
   - ProxyNotShell
+  - Qakbot
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -1,7 +1,7 @@
 name: Cmdline Tool Not Executed In CMD Shell
 id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
-version: 1
-date: '2021-09-14'
+version: 2
+date: '2022-10-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -15,8 +15,10 @@ description: The following analytic identifies a non-standard parent process (no
   This TTP is a good indicator for an adversary gathering host information, but one
   possible false positive might be an automated tool used by a system administator.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where  (Processes.process_name = "ipconfig.exe"
-  OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe"
+  OR Processes.process_name = "systeminfo.exe" OR Processes.process_name = "net.exe" OR Processes.process_name = "net1.exe" 
+  OR Processes.process_name = "arp.exe" OR Processes.process_name = "nslookup.exe" OR Processes.process_name = "route.exe"
+  OR Processes.process_name = "netstat.exe" OR Processes.process_name = "whoami.exe") AND NOT (Processes.parent_process_name
   = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe"
   OR Processes.parent_process_name = "explorer.exe") by Processes.parent_process_name
   Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id
@@ -38,6 +40,7 @@ tags:
   - FIN7
   - Qakbot
   - CISA AA22-277A
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/create_remote_thread_in_shell_application.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - IcedID
+  - Qakbot
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -46,6 +46,7 @@ tags:
   - DarkCrystal RAT
   - Brute Ratel C4
   - AgentTesla
+  - Qakbot
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 7

detections/endpoint/rubeus_command_line_parameters.yml

@@ -17,7 +17,7 @@ description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It
   this analytic.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*"
-  OR Processes.process = "* monitor *" OR Processes.process ="* asktgt* /user:*" OR
+  OR Processes.process = "* monitor /interval*" OR Processes.process ="* asktgt* /user:*" OR
   Processes.process ="* asktgs* /service:*" OR Processes.process ="* golden* /user:*"
   OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*"
   OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*"

detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml

@@ -16,7 +16,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
-  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
+  $cond_1 = | from $ssa_input | where process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
   process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
   process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
   process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 

detections/endpoint/suspicious_process_file_path.yml

@@ -42,6 +42,7 @@ tags:
   - DarkCrystal RAT
   - Brute Ratel C4
   - AgentTesla
+  - Qakbot
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml

@@ -39,6 +39,7 @@ tags:
   - Suspicious Regsvr32 Activity
   - Icedid
   - Living Off The Land
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/system_processes_run_from_unexpected_locations.yml

@@ -37,6 +37,7 @@ tags:
   - Unusual Processes
   - Ransomware
   - Masquerading - Rename System Utilities
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/system_user_discovery_with_whoami.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Qakbot
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Trickbot
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml

@@ -0,0 +1,69 @@
+name: Windows App Layer Protocol Wermgr Connect To NamedPipe
+id: 2f3a4092-548b-421c-9caa-84918e1787ef
+version: 1
+date: '2022-10-28'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a suspicious wermgr.exe process creating or connecting to a named pipe. 
+  Wermgr.exe is part of Windows OS Problem reporting application responsible for reporting problems, fault or error happen on 
+  the Windows OS. This file is being abused by several Threat actors and malware such as Trickbot and Qakbot to execute their malicious 
+  code. This anomaly detection can be a good pivot on possible wermgr.exe processes having injected malicious code that might be related to 
+  qakbot infection that communicates via named pipe.
+search: '`sysmon` EventCode IN (17, 18) Image= "*\\wermgr.exe" EventType IN ( "CreatePipe", "ConnectPipe")
+  | stats  min(_time) as firstTime max(_time) as lastTime count by Image EventType ProcessGuid ProcessId PipeName SecurityID EventCode Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_app_layer_protocol_wermgr_connect_to_namedpipe_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, pipename, processguid and named pipe event type from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://strontic.github.io/xcyclopedia/library/wermgr.exe-0F652BF7ADA772981E8AAB0D108FCC92.html
+- https://www.trellix.com/en-us/about/newsroom/stories/research/demystifying-qbot-malware.html
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Command And Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: wermgr.exe process is creating or connecting to a named pipe $PipeName$ in $Computer$
+  mitre_attack_id:
+  - T1071
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image 
+  - EventType
+  - ProcessGuid 
+  - ProcessId 
+  - PipeName 
+  - Computer 
+  - UserID
+  - SecurityID
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_command_shell_fetch_env_variables.yml

@@ -0,0 +1,75 @@
+name: Windows Command Shell Fetch Env Variables
+id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13
+version: 1
+date: '2022-10-27'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a suspicious process command line fetching the environment variables with a non-shell parent process. 
+  This technique was seen in qakbot malware where it fetches the environment variable in the target or compromised host. This TTP detection is a good pivot 
+  of possible malicious behavior since the command line is executed by a common non-shell process like cmd.exe , powershell.exe and many more. 
+  This can also be a good sign that the parent process has a malicious code injected to it to execute this command.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process = "*cmd /c set" OR Processes.process = "*cmd.exe /c set" AND NOT (Processes.parent_process_name = "cmd.exe" 
+  OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe" OR Processes.parent_process_name = "explorer.exe")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id 
+  Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_command_shell_fetch_env_variables_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: shell process that are not included in this search may cause False positive. Filter is needed.
+references:
+- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: non-shell parent process has a child process $process_name$ with a commandline $process$ to fetch env variables in $dest$
+  mitre_attack_id:
+  - T1055
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint

detections/endpoint/windows_dll_side_loading_in_calc.yml

@@ -0,0 +1,63 @@
+name: Windows DLL Side-Loading In Calc
+id: af01f6db-26ac-440e-8d89-2793e303f137
+version: 1
+date: '2022-10-24'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies suspicious DLL modules loaded by calc.exe that are not in windows %systemroot%\system32 or %systemroot%\sysWoW64 folder. 
+  This technique is well used by Qakbot malware to execute its malicious DLL file via dll side loading technique in calc process execution. 
+  This TTP detection is a good indicator that a suspicious dll was loaded in a public or non-common installation folder of Windows Operating System that needs further investigation. 
+search: '`sysmon` EventCode=7 Image = "*\calc.exe" AND NOT (Image IN ("*:\\windows\\system32\\*", "*:\\windows\\sysWow64\\*")) AND NOT(ImageLoaded IN("*:\\windows\\system32\\*", "*:\\windows\\sysWow64\\*", "*:\\windows\\WinSXS\\*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name Computer EventCode Signed ProcessId 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_dll_side_loading_in_calc_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on processes that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
+  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
+  latest TA for the endpoint product.
+known_false_positives: unknown
+references:
+- https://www.bitdefender.com/blog/hotforsecurity/new-qakbot-malware-strain-replaces-windows-calculator-dll-to-infected-pcs/
+tags:
+  analytic_story:
+  - Qakbot
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: a dll modules is loaded by calc.exe in $ImageLoaded$ that are not in common windows OS installation folder in $Computer$
+  mitre_attack_id:
+  - T1574.002
+  - T1574
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - OriginalFileName
+  - Product
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId
+  risk_score: 90
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml

@@ -0,0 +1,75 @@
+name: Windows DLL Side-Loading Process Child Of Calc
+id: 295ca9ed-e97b-4520-90f7-dfb6469902e1
+version: 1
+date: '2022-10-20'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the suspicious child process of calc.exe due to dll side loading technique to execute another executable. 
+  This technique was seen in qakbot malware that uses dll side loading technique to calc applications to load its malicious dll code. The malicious dll that abuses 
+  dll side loading technique will load the actual qakbot loader dll using regsvr32.exe application. 
+  This TTP is a good indicator of qakbot since the calc.exe will not load other child processes aside from win32calc.exe.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where (Processes.parent_process_name = "calc.exe")  AND Processes.process_name != "win32calc.exe"
+  by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  |`security_content_ctime(lastTime)` 
+  | `windows_dll_side_loading_process_child_of_calc_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process 
+  that include the name of the process responsible for the changes from your endpoints into the `Endpoint` 
+  datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and 
+  the latest TA for the endpoint product.
+known_false_positives: unknown
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: calc.exe has a child process $process_name$ in $dest$
+  mitre_attack_id:
+  - T1574.002
+  - T1574
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/windows_masquerading_explorer_as_child_process.yml

@@ -0,0 +1,73 @@
+name: Windows Masquerading Explorer As Child Process
+id: 61490da9-52a1-4855-a0c5-28233c88c481
+version: 1
+date: '2022-10-20'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a suspicious parent process of explorer.exe. 
+  Explorer is usually executed by userinit.exe that will exit after execution that causes the main explorer.exe no parent process. 
+  Some malware like qakbot spawn another explorer.exe to inject its code. This TTP detection is a good indicator that a process spawning explorer.exe 
+  might inject code or masquerading its parent child process to evade detections.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.parent_process_name IN("cmd.exe", "powershell.exe", "regsvr32.exe") AND Processes.process_name = "explorer.exe"
+  by Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest Processes.parent_process_id
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  |`security_content_ctime(lastTime)` 
+  | `windows_masquerading_explorer_as_child_process_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process 
+  that include the name of the process responsible for the changes from your endpoints into the `Endpoint` 
+  datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and 
+  the latest TA for the endpoint product.
+known_false_positives: unknown
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: explorer.exe hash a suspicious parent process $parent_process_name$ in $dest$
+  mitre_attack_id:
+  - T1574.002
+  - T1574
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml

@@ -0,0 +1,89 @@
+name: Windows Modify Registry Qakbot Binary Data Registry
+id: 2e768497-04e0-4188-b800-70dd2be0e30d
+version: 1
+date: '2022-10-21'
+author: Teoderick Contreras, Bhavin Patel, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a suspicious registry entry created by Qakbot malware as part of its malicious execution. 
+  This "Binary Data" Registry  was created by newly spawn explorer.exe where its malicious code is injected to it. The registry consist of 8 random registry value name 
+  with encrypted binary data on its registry value data. This anomaly detections can be a good pivot for possible Qakbot malware infection or other malware that uses registry 
+  to save or store there config or malicious code on the registry data stream. 
+search: '| tstats `security_content_summariesonly` count dc(registry_value_name) as registry_value_name_count FROM datamodel=Endpoint.Registry
+  where Registry.registry_path="*\\SOFTWARE\\Microsoft\\*" AND Registry.registry_value_data = "Binary Data"
+  by _time span=1m Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.process_id Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | rename process_guid as proc_guid 
+  | eval registry_key_name_len = len(registry_key_name) 
+  | eval registry_value_name_len = len(registry_value_name) 
+  | regex registry_value_name="^[0-9a-fA-F]{8}" 
+  | where registry_key_name_len < 80 AND registry_value_name_len == 8 
+  | join proc_guid, _time  
+    [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes 
+        where Processes.process_name IN  ("explorer.exe", "wermgr.exe","dxdiag.exe")
+        by _time span=1m Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid Processes.process_path 
+    | `drop_dm_object_name(Processes)` 
+    | rename process_guid as proc_guid 
+    | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data process_id registry_key_name registry_value_name_count] 
+  | stats min(_time) as firstTime max(_time) as lastTime values(registry_value_name) as registry_value_name dc(registry_value_name) as registry_value_name_count 
+  by process_path registry_key_name registry_value_data proc_guid registry_key_name_len registry_value_name_len 
+  | where registry_value_name_count >= 5
+  | `windows_modify_registry_qakbot_binary_data_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: unknown
+references:
+- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: registry with binary data $registry_path$ created by $process_name$ in $dest$
+  mitre_attack_id:
+  - T1112
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - dest 
+  - user 
+  - parent_process_name 
+  - parent_process 
+  - process_name 
+  - process_path 
+  - process 
+  - proc_guid 
+  - registry_path 
+  - registry_value_name 
+  - registry_value_data 
+  - process_id 
+  - registry_key_name 
+  - registry_key_name_len 
+  - registry_value_name_len
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml

@@ -0,0 +1,71 @@
+name: Windows Process Injection Of Wermgr to Known Browser
+id: aec755a5-3a2c-4be0-ab34-6540e68644e9
+version: 1
+date: '2022-10-28'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic identifies the suspicious Remote Thread execution of wermgr.exe process to "firefox.exe", "chrome.exe" and other known browsers. 
+  This technique was seen in Qakbot malware that executes its malicious code by injecting its code in legitimate Windows Operating System processes such as wermgr.exe 
+  to steal information in the compromised host. This TTP detection can be a good pivot to detect wermgr.exe process injected with qakbot code that tries to 
+  remote thread code execution in known browsers like firefox and edge which is not a common behavior of this wermgr.exe application.
+search: '`sysmon` EventCode=8 SourceImage = "*\\wermgr.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") 
+  | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage SourceProcessGuid SourceProcessId StartAddress StartFunction TargetProcessGuid TargetProcessId  EventCode Computer 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_process_injection_of_wermgr_to_known_browser_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the SourceImage, TargetImage, and EventCode executions from your endpoints
+  related to create remote thread or injecting codes. If you are using Sysmon, you
+  must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: unknown
+references:
+- https://news.sophos.com/en-us/2022/03/10/qakbot-decoded/
+- https://www.trellix.com/en-us/about/newsroom/stories/research/demystifying-qbot-malware.html
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/remote_thread/sysmon_wermgr_remote.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: wermgr.exe process $SourceImage$ create a remote thread to a browser process $TargetImage$ in host $Computer$
+  mitre_attack_id:
+  - T1055.001
+  - T1055
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage 
+  - TargetImage
+  - SourceProcessGuid
+  - SourceProcessId
+  - StartAddress
+  - StartFunction
+  - TargetProcessGuid
+  - TargetProcessId
+  - EventCode
+  - Computer 
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_process_injection_remote_thread.yml

@@ -0,0 +1,78 @@
+name: Windows Process Injection Remote Thread
+id: 8a618ade-ca8f-4d04-b972-2d526ba59924
+version: 1
+date: '2022-10-27'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a suspicious remote thread execution in some process being abused by threat actor and malware like 
+  qakbot. Qakbot is one of the malware using this technique to load its malicious dll module or malicious code in the targeted host. 
+  This TTP can be a good pivot to verify what is the behavior of the targeted Image process after this detection trigger. 
+  look for network connection, child process execution, file access and many more that helps to verify the indication of malware infection.
+search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe") 
+  | stats count min(_time) as firstTime max(_time) as lastTime by  TargetImage TargetProcessId SourceProcessId  EventCode StartAddress SourceImage Computer 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_process_injection_remote_thread_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts like remote thread EventCode=8 of sysmon.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: unknown
+references:
+- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: 80
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: process $SourceImage$ create a remote thread to process $TargetImage$ on host $Computer$
+  mitre_attack_id:
+  - T1055
+  - T1055.002
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: Process
+    role:
+    - Attacker
+  - name: TargetImage
+    type: Process
+    role:
+    - Target
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage
+  - TargetImage
+  - TargetProcessId
+  - SourceProcessId
+  - StartAddress
+  - EventCode
+  - Computer
+  - signature 
+  - TargetProcessGuid 
+  - SourceProcessGuid 
+  - StartAddress
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_process_injection_wermgr_child_process.yml

@@ -0,0 +1,74 @@
+name: Windows Process Injection Wermgr Child Process
+id: 360ae6b0-38b5-4328-9e2b-bc9436cddb17
+version: 1
+date: '2022-10-27'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a suspicious wermgr.exe parent process having a child process not related to error, fault or windows werfault event. 
+  This technique was seen in Qakbot malware where it inject its malicious code in wermgr to evade detections and hide from the analyst to execute its 
+  recon and its malicious behavior. This Anomaly detection can be a good pivot to start investigating a possible qakbot infection in the network. 
+  The Wermgr.exe process is not known to have other child processes aside from itself or werfault.exe
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.parent_process_name = "wermgr.exe" AND NOT (Processes.process_name IN ("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe"))
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id 
+  Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_process_injection_wermgr_child_process_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: unknown
+references:
+- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: wermgr parent process has a child process $process_name$ in $dest$
+  mitre_attack_id:
+  - T1055
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint

detections/endpoint/windows_regsvr32_renamed_binary.yml

@@ -0,0 +1,76 @@
+name: Windows Regsvr32 Renamed Binary
+id: 7349a9e9-3cf6-4171-bb0c-75607a8dcd1a
+version: 1
+date: '2022-10-27'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following hunting analytic identifies renamed instances of regsv32.exe executing. 
+  regsv32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. 
+  During investigation, validate if it is the legitimate regsv32.exe executing and what dll module content it is loading. 
+  This query relies on the original filename or internal name from the PE meta data. 
+  Expand the query as needed by looking for specific command line arguments outlined in other analytics.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name != regsvr32.exe AND Processes.original_file_name=regsvr32.exe 
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id 
+  Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_regsvr32_renamed_binary_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: unknown
+references:
+- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_3/sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: regsvr32 was renamed as $process_name$ in $dest$
+  mitre_attack_id:
+  - T1218.010
+  - T1218
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml

@@ -0,0 +1,74 @@
+name: Windows System Discovery Using ldap Nslookup
+id: 2418780f-7c3e-4c45-b8b4-996ea850cd49
+version: 1
+date: '2022-10-21'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies the execution of nslookup.exe tool to get domain information.
+  Nslookup.exe is a command-line tool that can display information to diagnose domain name systems. This Nslookup feature is being abused 
+  by Qakbot malware to gather domain information such as SRV service location records, server name and many more.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where (Processes.process_name = "nslookup.exe" OR Processes.original_file_name = "nslookup.exe") AND Processes.process = "*_ldap._tcp.dc._msdcs*" 
+  by Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  |`security_content_ctime(lastTime)` 
+  | `windows_system_discovery_using_ldap_nslookup_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: dministrator may execute this commandline tool for auditing purposes. Filter as needed.
+references:
+- https://securelist.com/qakbot-technical-analysis/103931/
+- https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/verify-srv-dns-records-have-been-created
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Reconnaissance
+  message: System nslookup domain discovery on $dest$
+  mitre_attack_id:
+  - T1033
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 25
+  security_domain: endpoint

detections/endpoint/windows_system_discovery_using_qwinsta.yml

@@ -0,0 +1,75 @@
+name: Windows System Discovery Using Qwinsta
+id: 2e765c1b-144a-49f0-93d0-1df4287cca04
+version: 1
+date: '2022-10-21'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies the execution of qwinsta.exe executable in Windows Operating System. 
+  This Windows executable file can display information about sessions on a remote desktop session host server. The information 
+  includes servername, sessionname, username and many more. This tool is being abused of Qakbot malware 
+  to gather information to the targeted or compromised host that will be send back to its Command and control server.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name = "qwinsta.exe" OR Processes.original_file_name = "qwinsta.exe"
+  by Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  |`security_content_ctime(lastTime)` 
+  | `windows_system_discovery_using_qwinsta_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Administrator may execute this commandline tool for auditing purposes. Filter as needed.
+references:
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/qwinsta
+- https://securelist.com/qakbot-technical-analysis/103931/
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Reconnaissance
+  message: System qwinsta domain discovery on $dest$
+  mitre_attack_id:
+  - T1033
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 25
+  security_domain: endpoint

detections/endpoint/windows_wmi_impersonate_token.yml

@@ -0,0 +1,71 @@
+name: Windows WMI Impersonate Token
+id: cf192860-2d94-40db-9a51-c04a2e8a8f8b
+version: 1
+date: '2022-10-24'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a possible wmi token impersonation activities in a process or command. 
+  This technique was seen in Qakbot malware where it will execute a vbscript code contains wmi impersonation object to gain privilege escalation or 
+  as defense evasion. This Anomaly detection looks for wmiprvse.exe SourceImage having a duplicate handle or full granted access in a target process. 
+search: '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe"  GrantedAccess IN ("0x1478", "0x1fffff")
+  | stats count min(_time) as firstTime max(_time) as lastTime 
+  by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId GrantedAccess CallTrace Computer
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_wmi_impersonate_token_filter`'
+how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
+  includes EventCode 10. This search uses an input macro named `sysmon`.
+  We strongly recommend that you specify your environment-specific configurations
+  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
+  with configurations for your Splunk environment. The search also uses a post-filter
+  macro designed to filter out known false positives.
+known_false_positives: administrator may execute impersonate wmi object script for auditing. Filter is needed.
+references:
+- https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/process-access.md
+- https://www.joesandbox.com/analysis/278341/0/html
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: wmiprvse.exe process having a duplicate or full Granted Access $GrantedAccess$ to $TargetImage$ process in $dest$ 
+  mitre_attack_id:
+  - T1047
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage 
+  - TargetImage 
+  - SourceProcessGUID 
+  - TargetProcessGUID 
+  - SourceProcessId 
+  - TargetProcessId 
+  - GrantedAccess 
+  - CallTrace 
+  - Computer
+  risk_score: 25
+  security_domain: endpoint

detections/experimental/application/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml

@@ -0,0 +1,54 @@
+name: Splunk Code Injection via custom dashboard leading to RCE
+id: b06b41d7-9570-4985-8137-0784f582a1b3
+version: 1
+date: '2022-10-11'
+author: Rod Soto
+type: Hunting
+datamodel: []
+description: This hunting search provides information about a vulnerability in Splunk Enterprise versions below 8.2.9, 8.1.12, 9.0.2, where an authenticated user can execute arbitrary code via the dashboard pdf generation component. Please review events with file=export in the _internal index for the potential targets of exploitation.
+search: '`splunkd_ui` uri_path=*/data/ui/views/* OR uri_path=*saved/searches/* | dedup uri_path | eval URL=urldecode("uri_path")| rex field=URL "\/saved\/searches\/(?<NAME>[^\/]*)" | rex field=URL "\/data\/ui\/views\/(?<NAME1>[^\/]*)" | eval NAME=NAME."( Saved Search )",NAME1=NAME1."( Dashboard )" | eval NAME=coalesce(NAME,NAME1) | eval STATUS=case(match(status,"2\d+"),"SUCCESS",match(status,"3\d+"),"REDIRECTION",match(status,"4\d+") OR match(status,"5\d+"),"ERROR") | stats list(NAME) as DASHBOARD_TITLE,list(method) as HTTP_METHOD,list(status) as Status_Code,list(STATUS) as STATUS by user | rename user as User | `splunk_code_injection_via_custom_dashboard_leading_to_rce_filter`'
+how_to_implement:  This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+known_false_positives: Not all exports and downloads are malicious, special attention must be put as well on /en-US/splunkd/__raw/services/pdfgen/render in the context of this search. 
+references:
+- https://www.splunk.com/en_us/product-security.html 
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint 
+  cve: 
+  - CVE-2022-43571
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint 
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_code_injection_via_custom_dashboard_leading_to_rce.txt
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: Potential exploitation of Code Injection via Dashboard PDF generation. 
+  mitre_attack_id:
+  - T1210
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - user
+  - clientip 
+  - uri 
+  - uri_path 
+  - method 
+  - status 
+  risk_score: 25
+  security_domain: endpoint

detections/experimental/cloud/detect_aws_console_login_by_new_user.yml

@@ -37,6 +37,8 @@ tags:
   cis20:
   - CIS 16
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1552
   confidence: 60
   context:

detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml

@@ -1,14 +1,14 @@
 name: Kubernetes AWS detect suspicious kubectl calls
 id: 042a3d32-8318-4763-9679-09db2644a8f2
-version: 1
-date: '2020-06-23'
+version: 2
+date: '2022-11-11'
 author: Rod Soto, Splunk
 type: Hunting
 datamodel: []
 description: This search provides information on anonymous Kubectl calls with IP,
   verb namespace and object access context
 search: '`aws_cloudwatchlogs_eks` userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1
-  src_user=system:anonymous  | table  src_ip src_user verb userAgent requestURI  |
+  src_user=system:anonymous  |
   stats  count by src_ip src_user verb userAgent requestURI |`kubernetes_aws_detect_suspicious_kubectl_calls_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with cloudwatch logs.

detections/web/exploit_public_facing_application_via_apache_commons_text.yml

@@ -1,4 +1,4 @@
-name: 'Exploit Public Facing Application via Apache Commons Text'
+name: Exploit Public Facing Application via Apache Commons Text
 id: 19a481e0-c97c-4d14-b1db-75a708eb592e
 version: 1
 date: '2022-10-26'
@@ -73,6 +73,9 @@ tags:
   - Web.src
   - Web.dest
   - Web.http_user_agent
+  - Web.status 
+  - Web.uri_query 
+  - Web.uri_path 
   risk_score: 49
   security_domain: network
   supported_tas:

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.51.0"
+      "version": "3.52.0"
     }, 
     "author": [
       {

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -67,6 +67,16 @@ annotations = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky.
 providing_technologies = null
 
+[savedsearch://ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This hunting search allows operator to discover attempts to exfiltrate data by executing a prepositioned malicious search ID in Analytic Workspace in Splunk Enterprise versions 8.2.9,8.1.12,9.0.2. The attack is browser-based. It requires the attacker to compel a victim to initiate a request within their browser (phishing). The attacker cannot exploit the vulnerability at will.
+how_to_implement = The vulnerability affects only instances with Splunk Web Enabled.  After running this search, please run "Splunk Command and Scripting Interpreter Risky SPL MLTK" to gain more insight into potentially risky commands which could lead to data exfiltration.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1567"], "nist": ["DE.CM"]}
+known_false_positives = This search may produce false positives.  This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. Special attention must be paid to "/en-US/app/search/analytics_workspace?sid=[sid]" which is where the malicious code will be inserted to trigger attack at victim.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk Digital Certificates Infrastructure Version - Rule]
 type = detection
 asset_type = Endpoint
@@ -147,6 +157,36 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
 providing_technologies = null
 
+[savedsearch://ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This hunting search provides information on possible exploitation attempts against Splunk Secure Gateway App Mobile Alerts feature in Splunk versions 9.0, 8.2.x, 8.1.x. An authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.
+how_to_implement = This search only applies if Splunk Mobile Gateway is deployed in the vulnerable Splunk versions.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.CM"]}
+known_false_positives = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. Focus of this search is "uri_path=/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" which is the injection point.
+providing_technologies = null
+
+[savedsearch://ESCU - Splunk Reflected XSS in the templates lists radio - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = Splunk versions below 8.1.12,8.2.9 and 9.0.2 are vulnerable to reflected cross site scripting (XSS). A View allows for a Reflected Cross Site scripting via JavaScript Object Notation (JSON) in a query parameter when ouput_mode=radio.
+how_to_implement = This vulnerability only affects instances with Splunk Web enabled. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+known_false_positives = This search may produce false positives as it is difficult to pinpoint all possible XSS injection characters in a single search string. Special attention is required to "en-US/list/entities/x/ui/views" which is the vulnerable injection point.
+providing_technologies = null
+
+[savedsearch://ESCU - Splunk Stored XSS via Data Model objectName field - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = Splunk Enterprise versions 8.1.12, 8.2.9, 9.0.2 are vulnerable to persistent cross site scripting via Data Model object name. An authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name Data Model.
+how_to_implement = This vulnerability only affects Splunk Web enabled instances. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+known_false_positives = This search may produce false positives and does not cover exploitation attempts via code obfuscation, focus of search is suspicious requests against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the injection point.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk User Enumeration Attempt - Rule]
 type = detection
 asset_type = endpoint
@@ -167,6 +207,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = Use of the monitoring console where the less-than sign (<) is the first character in the description field.
 providing_technologies = null
 
+[savedsearch://ESCU - Splunk XSS in Save table dialog header in search page - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This is a hunting search to find persistent cross-site scripting XSS code that was included while inputing data in 'Save Table' dialog in Splunk Enterprise (8.1.12,8.2.9,9.0.2). A remote user with "power" Splunk role can store this code that can lead to persistent cross site scripting.
+how_to_implement = Watch for POST requests combined with XSS script strings or obfuscation against the injection point /en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+known_false_positives = If host is vulnerable and XSS script strings are inputted they will show up in search. Not all Post requests are malicious as they will show when users create and save dashboards. This search may produce several results with non malicious POST requests. Only affects Splunk Web enabled instances.
+providing_technologies = null
+
 [savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
 type = detection
 asset_type = AWS Instance
@@ -724,7 +774,7 @@ asset_type = Azure Active Directory
 confidence = medium
 explanation = The following analytic identifies a successful authentication event against Azure Active Directory for an account without Multi-Factor Authentication enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated
 how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
-annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]}
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM"]}
 known_false_positives = Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
 providing_technologies = null
 
@@ -1014,6 +1064,66 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Exploitation"], "nist
 known_false_positives = None
 providing_technologies = null
 
+[savedsearch://ESCU - GCP Authentication Failed During MFA Challenge - Rule]
+type = detection
+asset_type = Google Cloud Platform tenant
+confidence = medium
+explanation = The following analytic identifies an authentication attempt event against a Google Cloud Platform tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. 
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the User log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004", "T1621"], "nist": ["DE.CM"]}
+known_false_positives = Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
+providing_technologies = null
+
+[savedsearch://ESCU - GCP Multi-Factor Authentication Disabled - Rule]
+type = detection
+asset_type = GCP
+confidence = medium
+explanation = The following analytic identifies an attempt to disable multi-factor authentication for a GCP user. An adversary who has obtained access to an GCP tenant may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account. This way the attackers can keep persistance in the environment without adding new users.
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the Admin log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1556"], "nist": ["DE.CM"]}
+known_false_positives = Legitimate use case may require for users to disable MFA. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - GCP Multiple Failed MFA Requests For User - Rule]
+type = detection
+asset_type = Google Cloud Platform tenant
+confidence = medium
+explanation = The following analytic identifies multiple failed multi-factor authentication requests for a single user within a Google Cloud Platform tenant. Specifically, the analytic triggers when 10 or more MFA user prompts fail within 5 minutes. Google CLoud tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `mfa_prompts` threshold values according to your environment. Specifically, this analytic leverages the User log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621", "T1078", "T1078.004"], "nist": ["DE.CM"]}
+known_false_positives = Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - GCP Multiple Users Failing To Authenticate From Ip - Rule]
+type = detection
+asset_type = Google Cloud Platform tenant
+confidence = medium
+explanation = The following analytic identifies one source Ip failing to authenticate into the Google Workspace user accounts with more than 20 unique valid users within 5 minutes. These user accounts may have other privileges with respect to access to other sensitive resources in the Google Cloud Platform. This behavior could represent an adversary performing a Password Spraying attack against an Google Workspace environment to obtain initial access or elevate privileges.
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. Specifically, this analytic leverages the User log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "nist": ["DE.CM"]}
+known_false_positives = No known false postives for this detection. Please review this alert.
+providing_technologies = null
+
+[savedsearch://ESCU - GCP Successful Single-Factor Authentication - Rule]
+type = detection
+asset_type = Google Cloud Platform tenant
+confidence = medium
+explanation = The following analytic identifies a successful authentication event against Google Cloud Platform for an account without Multi-Factor Authentication enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the User log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM"]}
+known_false_positives = Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
+providing_technologies = null
+
+[savedsearch://ESCU - GCP Unusual Number of Failed Authentications From Ip - Rule]
+type = detection
+asset_type = Google Cloud Platform tenant
+confidence = medium
+explanation = The following analytic identifies one source IP failing to authenticate into the Google Workspace with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against a Google Workspace enviroment to obtain initial access or elevate privileges. The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises.  While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `GCP Multiple Users Failing To Authenticate From Ip`
+how_to_implement = You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. Specifically, this analytic leverages the User log events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "nist": ["DE.CM"]}
+known_false_positives = No known false positives for this detection. Please review this alert
+providing_technologies = null
+
 [savedsearch://ESCU - GitHub Actions Disable Security Workflow - Rule]
 type = detection
 asset_type = GitHub
@@ -7903,6 +8013,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre
 known_false_positives = administrators rarely use adfind, usually not used for legitimate reasons
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows App Layer Protocol Wermgr Connect To NamedPipe - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a suspicious wermgr.exe process creating or connecting to a named pipe. Wermgr.exe is part of Windows OS Problem reporting application responsible for reporting problems, fault or error happen on the Windows OS. This file is being abused by several Threat actors and malware such as Trickbot and Qakbot to execute their malicious code. This anomaly detection can be a good pivot on possible wermgr.exe processes having injected malicious code that might be related to qakbot infection that communicates via named pipe.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, pipename, processguid and named pipe event type from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1071"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Application Layer Protocol RMS Radmin Tool Namedpipe - Rule]
 type = detection
 asset_type = Endpoint
@@ -7973,6 +8093,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = unknown
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Command Shell Fetch Env Variables - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a suspicious process command line fetching the environment variables with a non-shell parent process. This technique was seen in qakbot malware where it fetches the environment variable in the target or compromised host. This TTP detection is a good pivot of possible malicious behavior since the command line is executed by a common non-shell process like cmd.exe , powershell.exe and many more. This can also be a good sign that the parent process has a malicious code injected to it to execute this command.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]}
+known_false_positives = shell process that are not included in this search may cause False positive. Filter is needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Computer Account Created by Computer Account - Rule]
 type = detection
 asset_type = Endpoint
@@ -8222,6 +8352,26 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = False positives may be present, filtering may be required. Remove the Windows Shells macro to determine if other utilities are using iscsicpl.exe.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows DLL Side-Loading In Calc - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies suspicious DLL modules loaded by calc.exe that are not in windows %systemroot%\system32 or %systemroot%\sysWoW64 folder. This technique is well used by Qakbot malware to execute its malicious DLL file via dll side loading technique in calc process execution. This TTP detection is a good indicator that a suspicious dll was loaded in a public or non-common installation folder of Windows Operating System that needs further investigation.
+how_to_implement = To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows DLL Side-Loading Process Child Of Calc - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the suspicious child process of calc.exe due to dll side loading technique to execute another executable. This technique was seen in qakbot malware that uses dll side loading technique to calc applications to load its malicious dll code. The malicious dll that abuses dll side loading technique will load the actual qakbot loader dll using regsvr32.exe application. This TTP is a good indicator of qakbot since the calc.exe will not load other child processes aside from win32calc.exe.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows DotNet Binary in Non Standard Path - Rule]
 type = detection
 asset_type = Endpoint
@@ -8652,6 +8802,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Com
 known_false_positives = third party application may use this network protocol as part of its feature. Filter is needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Masquerading Explorer As Child Process - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a suspicious parent process of explorer.exe. Explorer is usually executed by userinit.exe that will exit after execution that causes the main explorer.exe no parent process. Some malware like qakbot spawn another explorer.exe to inject its code. This TTP detection is a good indicator that a process spawning explorer.exe might inject code or masquerading its parent child process to evade detections.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Modify Registry Disable Toast Notifications - Rule]
 type = detection
 asset_type = Endpoint
@@ -8702,6 +8862,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Modify Registry Qakbot Binary Data Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a suspicious registry entry created by Qakbot malware as part of its malicious execution. This "Binary Data" Registry  was created by newly spawn explorer.exe where its malicious code is injected to it. The registry consist of 8 random registry value name with encrypted binary data on its registry value data. This anomaly detections can be a good pivot for possible Qakbot malware infection or other malware that uses registry to save or store there config or malicious code on the registry data stream.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Modify Registry Regedit Silent Reg Import - Rule]
 type = detection
 asset_type = Endpoint
@@ -8956,6 +9126,36 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Rec
 known_false_positives = Administrators or power users may leverage PowerView for system management or troubleshooting.
 providing_technologies = ["Microsoft Windows"]
 
+[savedsearch://ESCU - Windows Process Injection Of Wermgr to Known Browser - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic identifies the suspicious Remote Thread execution of wermgr.exe process to "firefox.exe", "chrome.exe" and other known browsers. This technique was seen in Qakbot malware that executes its malicious code by injecting its code in legitimate Windows Operating System processes such as wermgr.exe to steal information in the compromised host. This TTP detection can be a good pivot to detect wermgr.exe process injected with qakbot code that tries to remote thread code execution in known browsers like firefox and edge which is not a common behavior of this wermgr.exe application.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055.001", "T1055"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Process Injection Remote Thread - Rule]
+type = detection
+asset_type = 80
+confidence = medium
+explanation = The following analytic identifies a suspicious remote thread execution in some process being abused by threat actor and malware like qakbot. Qakbot is one of the malware using this technique to load its malicious dll module or malicious code in the targeted host. This TTP can be a good pivot to verify what is the behavior of the targeted Image process after this detection trigger. look for network connection, child process execution, file access and many more that helps to verify the indication of malware infection.
+how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts like remote thread EventCode=8 of sysmon. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1055.002"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Process Injection Wermgr Child Process - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a suspicious wermgr.exe parent process having a child process not related to error, fault or windows werfault event. This technique was seen in Qakbot malware where it inject its malicious code in wermgr to evade detections and hide from the analyst to execute its recon and its malicious behavior. This Anomaly detection can be a good pivot to start investigating a possible qakbot infection in the network. The Wermgr.exe process is not known to have other child processes aside from itself or werfault.exe
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Process Injection With Public Source Path - Rule]
 type = detection
 asset_type = 80
@@ -9066,6 +9266,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.00
 known_false_positives = updated windows application needed in safe boot may used this registry
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Regsvr32 Renamed Binary - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following hunting analytic identifies renamed instances of regsv32.exe executing. regsv32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate if it is the legitimate regsv32.exe executing and what dll module content it is loading. This query relies on the original filename or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.010", "T1218"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Remote Access Software BRC4 Loaded Dll - Rule]
 type = detection
 asset_type = Endpoint
@@ -9266,6 +9476,26 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Del
 known_false_positives = False positives should be limited, filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows System Discovery Using ldap Nslookup - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the execution of nslookup.exe tool to get domain information. Nslookup.exe is a command-line tool that can display information to diagnose domain name systems. This Nslookup feature is being abused by Qakbot malware to gather domain information such as SRV service location records, server name and many more.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "nist": ["DE.CM"]}
+known_false_positives = dministrator may execute this commandline tool for auditing purposes. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows System Discovery Using Qwinsta - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the execution of qwinsta.exe executable in Windows Operating System. This Windows executable file can display information about sessions on a remote desktop session host server. The information includes servername, sessionname, username and many more. This tool is being abused of Qakbot malware to gather information to the targeted or compromised host that will be send back to its Command and control server.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "nist": ["DE.CM"]}
+known_false_positives = Administrator may execute this commandline tool for auditing purposes. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows System File on Disk - Rule]
 type = detection
 asset_type = Endpoint
@@ -9359,6 +9589,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = This behavior is not commonly seen in production environment and not advisable, filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows WMI Impersonate Token - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a possible wmi token impersonation activities in a process or command. This technique was seen in Qakbot malware where it will execute a vbscript code contains wmi impersonation object to gain privilege escalation or as defense evasion. This Anomaly detection looks for wmiprvse.exe SourceImage having a duplicate handle or full granted access in a target process.
+how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1047"], "nist": ["DE.CM"]}
+known_false_positives = administrator may execute impersonate wmi object script for auditing. Filter is needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows WMI Process Call Create - Rule]
 type = detection
 asset_type = Endpoint
@@ -9469,7 +9709,7 @@ confidence = medium
 explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
-known_false_positives = network administrator may used this command for checking purposes
+known_false_positives = Network administrator may used this command for checking purposes
 providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Wmic Group Discovery - Rule]
@@ -9746,6 +9986,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = This search may reveal non malicious URLs with environment variables used in organizations.
 providing_technologies = null
 
+[savedsearch://ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This hunting search provides information about a vulnerability in Splunk Enterprise versions below 8.2.9, 8.1.12, 9.0.2, where an authenticated user can execute arbitrary code via the dashboard pdf generation component. Please review events with file=export in the _internal index for the potential targets of exploitation.
+how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.CM"]}
+known_false_positives = Not all exports and downloads are malicious, special attention must be put as well on /en-US/splunkd/__raw/services/pdfgen/render in the context of this search.
+providing_technologies = null
+
 [savedsearch://ESCU - Suspicious Email Attachment Extensions - Rule]
 type = detection
 asset_type = Endpoint
@@ -10763,6 +11013,30 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Exploit Public Facing Application via Apache Commons Text - Rule]
+type = detection
+asset_type = Web Server
+confidence = medium
+explanation = The following analytic identifies activity related to Text4Shell, or the critical vulnerability CVE-2022-42889 in Apache Commons Text Library. Apache Commons Text versions 1.5 through 1.9 are affected, but it has been patched in version 1.10. The analytic may need to be tuned for your environment before enabling as a TTP, or direct Notable. Apache Commons Text is a Java library described as a library focused on algorithms working on strings. We can see it as a general-purpose text manipulation toolkit. This vulnerability affects the StringSubstitutor interpolator class, which is included in the Commons Text library. A default interpolator allows for string lookups that can lead to Remote Code Execution. This is due to a logic flaw that makes the script, dns, and url lookup keys interpolated by default, as opposed to what it should be, according to the documentation of the StringLookupFactory class. Those keys allow an attacker to execute arbitrary code via lookups.
+how_to_implement = To implement, one must be collecting network traffic that is normalized in CIM and able to be queried via the Web datamodel. Or, take the chunks out needed and tie to a specific network source type to hunt in. Tune as needed, or remove the other_lookups statement.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.CM"]}
+known_false_positives = False positives are present when the values are set to 1 for utf and lookup. It's possible to raise this to TTP (direct notable) if removal of other_lookups occur and Score is raised to 2 (down from 4).
+providing_technologies = null
+
+[savedsearch://ESCU - Fortinet Appliance Auth bypass - Rule]
+type = detection
+asset_type = Network
+confidence = medium
+explanation = CVE-2022-40684 is a Fortinet appliance auth bypass that is actively being exploited and a POC is released publicy. The POC adds a SSH key to the appliance. Note that the exploit can be used with any HTTP method (GET, POST, PUT, DELETE, etc). The REST API request failing is not an indication that an attacker was unsuccessful. Horizon3 was able to modify the admin SSH keys though a REST API request that reportedly failed. The collection /api/v2/ endpoints can be used to configure the system and modify the administrator user. Any logs found that meet the above conditions and also have a URL containing /api/v2/ should be cause for concern. Further investigation of any matching log entries can reveal any damage an attack has done. Additionally, an attacker may perform the following actions to further compromise a system Modify the admin SSH key to enable the attacker to login to the compromised system. \
+Add new local users. \
+Update networking configurations to reroute traffic. \
+Download the system configuration. \
+Initiate packet captures to capture other sensitive system information. Reference Horizon3.ai
+how_to_implement = This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache. Splunk for Nginx, or Splunk for Palo Alto.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+known_false_positives = GET requests will be noisy and need to be filtered out or removed from the query based on volume. Restrict analytic to known publically facing Fortigates, or run analytic as a Hunt until properly tuned. It is also possible the user agent may be filtered on Report Runner or Node.js only for the exploit, however, it is unknown at this if other user agents may be used.
+providing_technologies = null
+
 [savedsearch://ESCU - Log4Shell JNDI Payload Injection Attempt - Rule]
 type = detection
 asset_type = Endpoint
@@ -11100,7 +11374,7 @@ maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
 spec_version = 3
 searches = ["ESCU - Azure Active Directory High Risk Sign-in - Rule", "ESCU - Azure AD Authentication Failed During MFA Challenge - Rule", "ESCU - Azure AD Multi-Factor Authentication Disabled - Rule", "ESCU - Azure AD Multiple Failed MFA Requests For User - Rule", "ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - Azure AD Successful PowerShell Authentication - Rule", "ESCU - Azure AD Successful Single-Factor Authentication - Rule", "ESCU - Azure AD Unusual Number of Failed Authentications From Ip - Rule"]
 description = Monitor for activities and techniques associated with Account Takover attacks against Azure Active Directory tenants.
-narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization.\ This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.
+narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.
 
 [analytic_story://Azure Active Directory Persistence]
 category = Cloud Security
@@ -11299,6 +11573,17 @@ narrative = Credential dumping&#151;gathering credentials from a target system,
 Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\
 The detection searches in this Analytic Story monitor access to the Local Security Authority Subsystem Service (LSASS) process, the usage of shadowcopies for credential dumping and some other techniques for credential dumping.
 
+[analytic_story://CVE-2022-40684 Fortinet Appliance Auth bypass]
+category = Adversary Tactics
+last_updated = 2022-10-14
+version = 1
+references = ["https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/", "https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/", "https://github.com/horizon3ai/CVE-2022-40684", "https://attackerkb.com/topics/QWOxGIKkGx/cve-2022-40684/rapid7-analysis", "https://www.greynoise.io/blog/fortios-authentication-bypass"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Fortinet Appliance Auth bypass - Rule"]
+description = Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects CVE-2022-40684.
+narrative = FortiOS exposes a management web portal that allows a user configure the system. Additionally, a user can SSH into the system which exposes a locked down CLI interface. Any HTTP requests to the management interface of the system that match the conditions above should be cause for concern. An attacker can use this vulnerability to do just about anything they want to the vulnerable system. This includes changing network configurations, adding new users, and initiating packet captures. Note that this is not the only way to exploit this vulnerability and there may be other sets of conditions that work. For instance, a modified version of this exploit uses the User-Agent Node.js. This exploit seems to follow a trend among recently discovered enterprise software vulnerabilities where HTTP headers are improperly validated or overly trusted. (ref Horizon3.ai)
+
 [analytic_story://CyclopsBLink]
 category = Malware
 last_updated = 2022-04-07
@@ -11677,6 +11962,17 @@ searches = ["ESCU - Check Elevated CMD using whoami - Rule", "ESCU - Cmdline Too
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated with its payload, data collection and script execution.
 narrative = FIN7 is a Russian criminal advanced persistent threat group that has primarily targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. A portion of FIN7 is run out of the front company Combi Security. It has been called one of the most successful criminal hacking groups in the world. this passed few day FIN7 tools and implant are seen in the wild where its code is updated. the FIN& is known to use the spear phishing attack as a entry to targetted network or host that will drop its staging payload like the JS and JSSloader. Now this artifacts and implants seen downloading other malware like cobaltstrike and event ransomware to encrypt host.
 
+[analytic_story://GCP Account Takeover]
+category = Account Compromise
+last_updated = 2022-10-12
+version = 1
+references = ["https://cloud.google.com/gcp", "https://cloud.google.com/architecture/identity/overview-google-authentication", "https://attack.mitre.org/techniques/T1586/", "https://www.imperva.com/learn/application-security/account-takeover-ato/", "https://www.barracuda.com/glossary/account-takeover"]
+maintainers = [{"company": "Bhavin Patel, Splunk", "email": "-", "name": "Mauricio Velazco"}]
+spec_version = 3
+searches = ["ESCU - GCP Authentication Failed During MFA Challenge - Rule", "ESCU - GCP Multi-Factor Authentication Disabled - Rule", "ESCU - GCP Multiple Failed MFA Requests For User - Rule", "ESCU - GCP Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - GCP Successful Single-Factor Authentication - Rule", "ESCU - GCP Unusual Number of Failed Authentications From Ip - Rule"]
+description = Monitor for activities and techniques associated with Account Takover attacks against Google Cloud Platform tenants.
+narrative = Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.
+
 [analytic_story://GCP Cross Account Activity]
 category = Cloud Security
 last_updated = 2020-09-01
@@ -12159,6 +12455,17 @@ searches = ["ESCU - Detect Exchange Web Shell - Rule", "ESCU - Exchange PowerShe
 description = ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server - CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.
 narrative = During Pwn2Own April 2021, a security researcher demonstrated an attack  chain targeting on-premise Microsoft Exchange Server. August 5th, the same researcher  publicly released further details and demonstrated the attack chain. CVE-2021-34473  Pre-auth path confusion leads to ACL Bypass (Patched in April by KB5001779)  CVE-2021-34523 - Elevation of privilege on Exchange PowerShell backend (Patched in April by KB5001779) . CVE-2021-31207 - Post-auth Arbitrary-File-Write  leads to RCE (Patched in May by KB5003435) Upon successful exploitation,  the remote attacker will have SYSTEM privileges on the Exchange Server. In addition    to remote access/execution, the adversary may be able to run Exchange PowerShell  Cmdlets to perform further actions.
 
+[analytic_story://Qakbot]
+category = Malware
+last_updated = 2022-10-12
+version = 1
+references = ["https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf", "https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot", "https://securelist.com/qakbot-technical-analysis/103931/", "https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
+spec_version = 3
+searches = ["ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Network Discovery Using Route Windows App - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - System User Discovery With Whoami - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Windows App Layer Protocol Wermgr Connect To NamedPipe - Rule", "ESCU - Windows Command Shell Fetch Env Variables - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DLL Side-Loading In Calc - Rule", "ESCU - Windows DLL Side-Loading Process Child Of Calc - Rule", "ESCU - Windows Masquerading Explorer As Child Process - Rule", "ESCU - Windows Modify Registry Qakbot Binary Data Registry - Rule", "ESCU - Windows Process Injection Of Wermgr to Known Browser - Rule", "ESCU - Windows Process Injection Remote Thread - Rule", "ESCU - Windows Process Injection Wermgr Child Process - Rule", "ESCU - Windows Regsvr32 Renamed Binary - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows System Discovery Using ldap Nslookup - Rule", "ESCU - Windows System Discovery Using Qwinsta - Rule", "ESCU - Windows WMI Impersonate Token - Rule", "ESCU - Windows WMI Process Call Create - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule"]
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Qakbot/QBot malware including parent-child process anomalies, persistence, initial access, recon and many more. Qakbot is a modular information stealer that has been active since 2007. It is also has historical background to be banking Trojan that steals financial data from infected or compromised system.
+narrative = Qakbot is also known to leverage tools like powershell, process injection, and mimikatz for its malicious activities. This malware was on the CISA top malware list for 2021.
+
 [analytic_story://Ransomware]
 category = Malware
 last_updated = 2020-02-04
@@ -12326,7 +12633,7 @@ version = 1
 references = ["https://www.splunk.com/en_us/product-security/announcements.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
 spec_version = 3
-searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
+searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
 description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.
 narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly.
 
@@ -12611,6 +12918,17 @@ description = Attackers are using Zoom as an vector to increase privileges on a
 narrative = Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\
 Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation.
 
+[analytic_story://Text4Shell CVE-2022-42889]
+category = Adversary Tactics
+last_updated = 2022-10-26
+version = 1
+references = ["https://sysdig.com/blog/cve-2022-42889-text4shell/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Exploit Public Facing Application via Apache Commons Text - Rule"]
+description = A new critical vulnerability CVE-2022-42889 a.k.a. Text4shell, similar to the old Spring4Shell and Log4Shell, was originally reported by Alvaro Munoz on the very popular Apache Commons Text library.
+narrative = Apache Commons Text is a Java library described as "a library focused on algorithms working on strings." We can see it as a general-purpose text manipulation toolkit. This vulnerability affects the StringSubstitutor interpolator class, which is included in the Commons Text library. A default interpolator allows for string lookups that can lead to Remote Code Execution. This is due to a logic flaw that makes the "script," "dns," and "url" lookup keys interpolated by default, as opposed to what it should be, according to the documentation of the StringLookupFactory class. Those keys allow an attacker to execute arbitrary code via lookups. In order to exploit the vulnerabilities, the following requirements must be met - Run a version of Apache Commons Text from version 1.5 to 1.9 and use the StringSubstitutor interpolator. It is important to specify that the StringSubstitutor interpolator is not as widely used as the string substitution in Log4j, which led to Log4Shell. According to the CVSSv3 system, it scores 9.8 as CRITICAL severity. The severity is Critical due to the easy exploitability and huge potential impact in terms of confidentiality, integrity, and availability. As we showed in the previous section, you can take full control over the vulnerable system with a crafted request. However, it is not likely the vulnerabilities will have the same impacts as the previous Log4Shell and Spring4Shell.
+
 [analytic_story://Trickbot]
 category = Malware
 last_updated = 2021-04-20

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 10578
+build = 10902
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.51.0
+version = 3.52.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 3.51.0
+version = 3.52.0

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -29,6 +29,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_data_exfiltration_from_analytics_workspace_using_sid_query_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_digital_certificates_infrastructure_version_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -61,6 +65,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[splunk_reflected_xss_in_the_templates_lists_radio_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[splunk_stored_xss_via_data_model_objectname_field_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_user_enumeration_attempt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -69,6 +85,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_xss_in_save_table_dialog_header_in_search_page_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -405,6 +425,30 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[gcp_authentication_failed_during_mfa_challenge_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_multi_factor_authentication_disabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_multiple_failed_mfa_requests_for_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_multiple_users_failing_to_authenticate_from_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_successful_single_factor_authentication_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_unusual_number_of_failed_authentications_from_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [github_actions_disable_security_workflow_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3101,6 +3145,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_app_layer_protocol_wermgr_connect_to_namedpipe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3129,6 +3177,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_command_shell_fetch_env_variables_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_computer_account_created_by_computer_account_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3225,6 +3277,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_dll_side_loading_in_calc_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_dll_side_loading_process_child_of_calc_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_dotnet_binary_in_non_standard_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3389,6 +3449,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_masquerading_explorer_as_child_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_modify_registry_disable_toast_notifications_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3409,6 +3473,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_modify_registry_qakbot_binary_data_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_modify_registry_regedit_silent_reg_import_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3509,6 +3577,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_process_injection_of_wermgr_to_known_browser_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_process_injection_remote_thread_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_process_injection_wermgr_child_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_process_injection_with_public_source_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3553,6 +3633,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_regsvr32_renamed_binary_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_remote_access_software_brc4_loaded_dll_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3633,6 +3717,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_system_discovery_using_ldap_nslookup_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_system_discovery_using_qwinsta_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_system_file_on_disk_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3669,6 +3761,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_wmi_impersonate_token_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_wmi_process_call_create_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3817,6 +3913,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_code_injection_via_custom_dashboard_leading_to_rce_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [suspicious_email_attachment_extensions_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4209,6 +4309,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[exploit_public_facing_application_via_apache_commons_text_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[fortinet_appliance_auth_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [log4shell_jndi_payload_injection_attempt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4250,6 +4358,10 @@ definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
 
+[audit_searches]
+definition = index=_audit sourcetype=audittrail action=search
+description = Macro to enable easy searching of audittrail logs for searches
+
 [aws_cloudwatchlogs_eks]
 definition = sourcetype="aws:cloudwatchlogs:eks"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -4406,6 +4518,18 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = sourcetype=gsuite:gmail:bigquery
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[gws_login_mfa_methods]
+definition = event.parameters{}.multiValue{} IN ("backup_code", "google_authenticator", "google_prompt", "idv_any_phone", "idv_preregistered_phone", "internal_two_factor", "knowledge_employee_id", "knowledge_preregistered_email", "login_location", "knowledge_preregistered_phone", "offline_otp", "security_key", "security_key_otp")
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[gws_reports_admin]
+definition = sourcetype=gws:reports:admin
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[gws_reports_login]
+definition = sourcetype=gws:reports:login
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [is_net_windows_file]
 definition = lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true
 description = This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11.
@@ -4710,6 +4834,10 @@ description = Matches the process with its original file name, data for this mac
 definition = (Processes.process_name=wbadmin.exe OR Processes.original_file_name=WBADMIN.EXE)
 description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
 
+[process_wermgr]
+definition = (Processes.process_name=wermgr.exe OR Processes.original_file_name=wermgr.EXE)
+description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+
 [process_wmic]
 definition = (Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)
 description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
@@ -4767,10 +4895,22 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = index=_audit "action=login attempt" "info=failed"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[splunkd_ui]
+definition = index=_internal sourcetype=splunkd_ui_access
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [splunkd_web]
 definition = index=_internal sourcetype=splunk_web_access
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[splunkd_webx]
+definition = index=_internal sourcetype=access_combined_wcookie
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[splunkda]
+definition = index=_internal sourcetype=splunkd_access
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [stream_dns]
 definition = sourcetype=stream:dns
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-10-18T20:46:45 UTC
+# On Date: 2022-11-02T17:55:06 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml

@@ -48,6 +48,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/
+  event_schema: cim
 test:
   name: Anomalous usage of Archive Tools Unit Test
   tests:

dist/ssa/srs/ssa___attempt_to_delete_services.yml

@@ -56,6 +56,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/a0c8c292-d01a-11eb-aa18-acde48001122/
+  event_schema: cim
 test:
   name: Attempt To Delete Services Unit Test
   tests:

dist/ssa/srs/ssa___attempt_to_disable_services.yml

@@ -55,6 +55,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/afb31de4-d023-11eb-98d5-acde48001122/
+  event_schema: cim
 test:
   name: Attempt To Disable Services Unit Test
   tests:

dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -51,6 +51,7 @@ tags:
   security_domain: endpoint
   risk_severity: medium
   research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/
+  event_schema: cim
 test:
   name: Attempted Credential Dump From Registry via Reg exe Unit Test
   tests:

dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml

@@ -49,6 +49,7 @@ tags:
   security_domain: endpoint
   risk_severity: high
   research_site_url: https://research.splunk.com/endpoint/76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13/
+  event_schema: cim
 test:
   name: BCDEdit Failure Recovery Modification Unit Test
   tests:

dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml

@@ -55,6 +55,7 @@ tags:
   security_domain: endpoint
   risk_severity: high
   research_site_url: https://research.splunk.com/endpoint/8f907d90-6173-11ec-9c23-acde48001122/
+  event_schema: cim
 test:
   name: Clear Unallocated Sector Using Cipher - SSA Unit test
   tests:

dist/ssa/srs/ssa___delete_a_net_user.yml

@@ -54,6 +54,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/8776d79c-d26e-11eb-9a56-acde48001122/
+  event_schema: cim
 test:
   name: Delete A Net User Unit Test
   tests:

dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml

@@ -52,6 +52,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/b76eae28-cd25-11eb-9c92-acde48001122/
+  event_schema: cim
 test:
   name: Deny Permission using Cacls Utility Unit Test
   tests:

dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -54,6 +54,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd80-4ffa-a844-25026e0a0c94/
+  event_schema: cim
 test:
   name: Detect Prohibited Applications Spawning cmd exe Unit Test
   tests:

dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml

@@ -59,6 +59,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/e8b74268-5454-11ec-a799-acde48001122/
+  event_schema: cim
 test:
   name: Detect RClone Command-Line Usage Unit Test
   tests:

dist/ssa/srs/ssa___disable_net_user_account.yml

@@ -55,6 +55,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/ba858b08-d26c-11eb-af9b-acde48001122/
+  event_schema: cim
 test:
   name: Disable Net User Account Unit Test
   tests:

dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml

@@ -55,6 +55,7 @@ tags:
   security_domain: endpoint
   risk_severity: medium
   research_site_url: https://research.splunk.com/endpoint/2452e632-9e0d-11eb-34ba-acde48001122/
+  event_schema: cim
 test:
   name: DNS Exfiltration Using Nslookup App Unit Test
   tests:

dist/ssa/srs/ssa___fsutil_zeroing_file.yml

@@ -49,6 +49,7 @@ tags:
   security_domain: endpoint
   risk_severity: medium
   research_site_url: https://research.splunk.com/endpoint/f792cdc9-43ee-4429-a3c0-ffce4fed1a85/
+  event_schema: cim
 test:
   name: Fsutil Zeroing File Unit Test
   tests:

dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml

@@ -52,6 +52,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/c6da561a-cd29-11eb-ae65-acde48001122/
+  event_schema: cim
 test:
   name: Grant Permission Using Cacls Utility Unit Test
   tests:

dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml

@@ -49,6 +49,7 @@ tags:
   security_domain: endpoint
   risk_severity: medium
   research_site_url: https://research.splunk.com/endpoint/028e4406-6176-11ec-aec2-acde48001122/
+  event_schema: cim
 test:
   name: Hiding Files And Directories With Attrib exe - SSA Unit test
   tests:

dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml

@@ -55,6 +55,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/9ae9a48a-cdbe-11eb-875a-acde48001122/
+  event_schema: cim
 test:
   name: Modify ACLs Permission Of Files Or Folders Unit Test
   tests:

dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml

@@ -0,0 +1,65 @@
+name: Office Product Spawning Windows Script Host
+id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6
+version: 1
+description: The following analytic will identify a Windows Office Product spawning
+  WScript.exe or CScript.exe. Tuning may be required based on legitimate application
+  usage that may spawn scripts from an Office product.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"),
+  "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name
+  IS NOT NULL | where (like(parent_process_name, "%\\\\winword.exe") OR like(parent_process_name,
+  "%\\\\excel.exe") OR like(parent_process_name, "%\\\\powerpnt.exe") OR like(parent_process_name,
+  "%\\\\mspub.exe") OR like(parent_process_name, "%\\\\visio.exe")) AND (process_name="wscript.exe"
+  OR process_name="cscript.exe") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present based on macro based approved
+  documents in the organization. Filtering may be needed.
+references:
+- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  cis20:
+  - CIS 8
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566
+  - T1566.001
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 63
+  security_domain: endpoint
+  risk_severity: medium
+  research_site_url: https://research.splunk.com/endpoint/3ea3851a-8736-41a0-bc09-7e4485b48fa6/
+  event_schema: cim
+test:
+  name: Office Product Spawning Windows Script Host Unit Test
+  tests:
+  - name: Office Product Spawning Windows Script Host
+    file: endpoint/ssa___office_product_spawning_windows_script_host.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
+      source: XmlWinEventLog

dist/ssa/srs/ssa___resize_shadowstorage_volume.yml

@@ -54,6 +54,7 @@ tags:
   security_domain: endpoint
   risk_severity: medium
   research_site_url: https://research.splunk.com/endpoint/dbc30554-d27e-11eb-9e5e-acde48001122/
+  event_schema: cim
 test:
   name: Resize Shadowstorage Volume Unit Test
   tests:

dist/ssa/srs/ssa___sdelete_application_execution.yml

@@ -64,6 +64,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/
+  event_schema: cim
 test:
   name: Sdelete Application Execution Unit Test
   tests:

dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml

@@ -250,6 +250,7 @@ tags:
   security_domain: endpoint
   risk_severity: medium
   research_site_url: https://research.splunk.com/endpoint/28179107-099a-464a-94d3-08301e6c055f/
+  event_schema: cim
 test:
   name: System Process Running from Unexpected Location Unit Test
   tests:

dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml

@@ -52,6 +52,7 @@ tags:
   security_domain: endpoint
   risk_severity: low
   research_site_url: https://research.splunk.com/endpoint/71efbf52-4dbb-4c00-a520-306aa546cbb7/
+  event_schema: cim
 test:
   name: WBAdmin Delete System Backups Unit Test
   tests: