Merge branch 'develop' into nterl0k-t1569-windows-sus-services-lookup

2026-06-08 17:32:49 +00:00 · 2025-02-19 22:05:45 +01:00
parent fb4a5ea9f4 82bdfb3956
commit ea641c5f97
234 changed files with 11991 additions and 9899 deletions
@@ -2,6 +2,8 @@
  <view name="escu_summary" default="true"/>
  <view name="feedback"/>
  <view name="search"/>
-  <view name="dashboards"/>
-  <a href="http://docs.splunk.com/Documentation/ESSOC">Docs</a>
+  <collection label="Dashboards">
+    <view source="unclassified" match="__"/>
+  </collection>
+  <a href="https://docs.splunk.com/Documentation/ESCU">Docs</a>
 </nav>
@@ -77,9 +77,9 @@ apps:
 - uid: 5579
  title: Splunk Add-on for CrowdStrike FDR
  appid: Splunk_TA_CrowdStrike_FDR
-  version: 2.0.3
+  version: 2.0.4
  description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-crowdstrike-fdr_203.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-crowdstrike-fdr_204.tgz
 - uid: 3185
  title: Splunk Add-on for Microsoft IIS
  appid: SPLUNK_TA_FOR_IIS
@@ -206,4 +206,10 @@ apps:
  version: 4.2.2
  description: PSC for MLTK
  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/python-for-scientific-computing-for-linux-64-bit_422.tgz
+- uid: 2882
+  title: Splunk Add-on for AppDynamics
+  appid: Splunk_TA_AppDynamics
+  version: 3.0.0
+  description: The Splunk Add-on for AppDynamics enables you to easily configure data inputs to pull data from AppDynamics' REST APIs
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-appdynamics_300.tgz
 githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd
@@ -10,7 +10,7 @@ separator: event_simpleName
 supported_TA:
 - name: Splunk Add-on for CrowdStrike FDR
  url: https://splunkbase.splunk.com/app/5579
-  version: 2.0.3
+  version: 2.0.4
 fields:
 - AuthenticationId
 - AuthenticationId_meaning
@@ -96,6 +96,7 @@ field_mappings:
  mapping:
    CommandLine: Processes.process
    ImageFileName: Processes.process_path
+    ImageFileName|endswith: Processes.process_name
    ParentBaseFileName: Processes.parent_process_name
    ParentProcessId: Processes.parent_process_id
    RawProcessId: Processes.process_id
@@ -6,7 +6,21 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Nginx Access
 source: /var/log/nginx/access.log
 sourcetype: nginx:plus:kv
-supported_TA: []
+supported_TA:
+- name: Splunk Add-on for NGINX
+  url: https://splunkbase.splunk.com/app/3258
+  version: 3.3.0
+field_mappings:
+- data_model: cim
+  data_set: Web
+  mapping:
+    server: Web.dest
+    http_method: Web.http_method
+    http_user_agent: Web.http_user_agent
+    status: Web.status
+    uri_path: Web.url
+    url_length: Web.url_length
+    src_ip: Web.src
 fields:
 - _time
 - action
@@ -10,6 +10,16 @@ supported_TA:
 - name: Palo Alto Networks Add-on
  url: https://splunkbase.splunk.com/app/2757
  version: 8.1.3
+field_mappings:
+- data_model: cim
+  data_set: Web
+  mapping:
+    dest: Web.dest
+    http_method: Web.http_method
+    http_user_agent: Web.http_user_agent
+    url: Web.url
+    url_length: Web.url_length
+    src: Web.src
 fields:
 - _time
 - date_hour
@@ -29,6 +29,16 @@ fields:
 - splunk_server
 - timeendpos
 - timestartpos
+field_mappings:
+- data_model: cim
+  data_set: All_Traffic
+  mapping:
+    app: All_Traffic.app
+    action: All_Traffic.action
+    dest_ip: All_Traffic.dest_ip
+    dest_port: All_Traffic.dest_port
+    src_ip: All_Traffic.src_ip
+    src_port: All_Traffic.src_port
 example_log: 577 <14>1 2024-02-22T12:33:50-05:00 PALO220.ATTACK_RANGE.LAN - - - -
  1,2024/02/22 12:33:50,012801036556,TRAFFIC,end,2305,2024/02/22 12:33:50,192.168.1.205,147.28.146.44,201.17.96.104,147.28.146.44,No_Vuln_Filtering_OUT,,,screenconnect,vsys1,Trust,Untrust,ethernet1/2,ethernet1/1,splunk_range,2024/02/22
  12:33:50,14740,1,50624,443,11024,443,0x40005e,tcp,allow,7419,6609,810,25,2024/02/22
@@ -6,7 +6,21 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Suricata
 source: suricata
 sourcetype: suricata
-supported_TA: []
+supported_TA:
+- name: Splunk TA for Suricata
+  url: https://splunkbase.splunk.com/app/2760
+  version: 2.3.3
+field_mappings:
+- data_model: cim
+  data_set: Web
+  mapping:
+    http.hostname: Web.dest
+    http.http_method: Web.http_method
+    http.http_user_agent: Web.http_user_agent
+    http.status: Web.status
+    http.url: Web.url
+    http.length: Web.url_length
+    src_ip: Web.src
 fields:
 - _time
 - app_proto
@@ -125,7 +125,7 @@ field_mappings:
    Hashes: Processes.process_hash
    ParentProcessGuid: Processes.parent_process_guid
    ParentProcessId: Processes.parent_process_id
-    ParentImage: Processes.parent_process_name
+    ParentImage|endswith: Processes.parent_process_name
    ParentCommandLine: Processes.parent_process
    Computer: Processes.dest
    OriginalFileName: Processes.original_file_name
@@ -92,6 +92,7 @@ field_mappings:
    ProcessGuid: Filesystem.process_guid
    ProcessId: Filesystem.process_id
    TargetFilename: Filesystem.file_path
+    TargetFilename|endswith: Filesystem.file_name
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
  Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>11</EventID><Version>2</Version><Level>4</Level><Task>11</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
  SystemTime='2023-02-08T13:01:11.065939500Z'/><EventRecordID>7712490</EventRecordID><Correlation/><Execution
@@ -87,6 +87,14 @@ fields:
 - timestartpos
 - user_id
 - vendor_product
+field_mappings:
+- data_model: cim
+  data_set: Endpoint.Registry
+  mapping:
+    Computer: Registry.dest
+    ProcessGuid: Registry.process_guid
+    ProcessId: Registry.process_id
+    TargetObject: Registry.registry_path
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
  Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>12</EventID><Version>2</Version><Level>4</Level><Task>12</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
  SystemTime='2021-07-12T08:10:32.607068200Z'/><EventRecordID>1055579</EventRecordID><Correlation/><Execution
@@ -102,7 +102,10 @@ field_mappings:
    ProcessGuid: Registry.process_guid
    ProcessId: Registry.process_id
    TargetObject: Registry.registry_path
-    Details: Registry.registry_value_data
+    Details|in: Registry.registry_value_data
+    action: Registry.action
+    TargetObject|startswith: Registry.registry_key_name
+    TargetObject|endswith: Registry.registry_value_name
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
  Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>13</EventID><Version>2</Version><Level>4</Level><Task>13</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
  SystemTime='2021-07-12T08:11:04.548083500Z'/><EventRecordID>810987</EventRecordID><Correlation/><Execution
@@ -12,6 +12,13 @@ supported_TA:
 - name: Splunk Add-on for Sysmon
  url: https://splunkbase.splunk.com/app/5709
  version: 4.0.2
+field_mappings:
+- data_model: cim
+  data_set: DNS
+  mapping:
+    QueryResults: DNS.answer
+    QueryName: DNS.query
+    Computer: DNS.src
 fields:
 - _time
 - Channel
@@ -100,6 +100,25 @@ fields:
 - timestartpos
 - user
 - vendor_product
+field_mappings:
+- data_model: cim
+  data_set: Endpoint.Processes
+  mapping:
+    ProcessGuid: Processes.process_guid
+    ProcessId: Processes.process_id
+    Image: Processes.process_path
+    Image|endswith: Processes.process_name
+    CommandLine: Processes.process
+    CurrentDirectory: Processes.process_current_directory
+    User: Processes.user
+    IntegrityLevel: Processes.process_integrity_level
+    Hashes: Processes.process_hash
+    ParentProcessGuid: Processes.parent_process_guid
+    ParentProcessId: Processes.parent_process_id
+    ParentImage: Processes.parent_process_name
+    ParentCommandLine: Processes.parent_process
+    Computer: Processes.dest
+    OriginalFileName: Processes.original_file_name
 example_log: <Event><System><Provider Name="Linux-Sysmon" Guid="{ff032593-a8d3-4f13-b0d6-01fc615a0f97}"/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
  SystemTime="2022-08-09T10:42:47.749450000Z"/><EventRecordID>1926574</EventRecordID><Correlation/><Execution
  ProcessID="1465" ThreadID="1465"/><Channel>Linux-Sysmon/Operational</Channel><Computer>ar-linux</Computer><Security
@@ -78,6 +78,14 @@ fields:
 - timestartpos
 - user
 - vendor_product
+field_mappings:
+- data_model: cim
+  data_set: Endpoint.Filesystem
+  mapping:
+    Computer: Filesystem.dest
+    ProcessGuid: Filesystem.process_guid
+    ProcessId: Filesystem.process_id
+    TargetFilename: Filesystem.file_path
 example_log: <Event><System><Provider Name="Linux-Sysmon" Guid="{ff032593-a8d3-4f13-b0d6-01fc615a0f97}"/><EventID>11</EventID><Version>2</Version><Level>4</Level><Task>11</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
  SystemTime="2021-12-20T16:07:17.927963000Z"/><EventRecordID>792913</EventRecordID><Correlation/><Execution
  ProcessID="4372" ThreadID="4372"/><Channel>Linux-Sysmon/Operational</Channel><Computer>sysmonlinux-tcontreras-attack-range-4134</Computer><Security
@@ -0,0 +1,88 @@
+name: Cisco Secure Application Alerts
+id: 9982bff4-fc5d-49a3-ab9e-2dbbab2a711b
+version: 1
+date: '2025-02-04'
+author: Ryan Long, Bhavin Patel, Splunk
+status: production
+type: Anomaly
+description: |
+  The following analytic is to leverage alerts from Cisco SecureApp, which identifies and monitors exploit attempts targeting business applications. The primary attack observed involves exploiting vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J and zero day attacks. These attacks are typically aimed at gaining unauthorized access, exfiltrating sensitive data, or disrupting application functionality.
+
+  Cisco SecureApp provides real-time detection of these threats by analyzing application-layer events and correlating attack behavior with known vulnerability signatures. This detection methodology helps the Security Operations Center (SOC) by:
+
+  * Identifying active exploitation attempts in real-time, allowing for quicker incident response.
+  * Categorizing attack severity to prioritize remediation efforts based on risk level.
+  * Providing visibility into attacker tactics, including source IP, attack techniques, and affected applications.
+  * Generating risk-based scoring and contextual alerts to enhance decision-making within SOC workflows.
+  * Helping analysts determine whether an attack was merely an attempt or if it successfully exploited a vulnerability.
+
+  By leveraging this information, SOC teams can proactively mitigate security threats, patch vulnerable applications, and enforce security controls to prevent further exploitation.
+data_source:
+- Cisco Secure Application AppDynamics Alerts
+search: |-
+  `appdynamics_security` blocked=false 
+  | rename attackEvents{}.attackOutcome AS attackOutcome, "attackEvents{}.vulnerabilityInfo.*" AS * 
+  | fields - tag::eventtype, eventtype, host, id, index, linecount, punct, source, sourcetype, splunk_server, tag, SourceType, app clientAddressType, application, tier, "attackEvents{}.*" 
+  | eval socketOut=mvjoin(socketOut," AND ") 
+  | eval risk_score=kennaScore 
+  | fillnull risk_score value="0" 
+  | eval risk_object=app_name 
+  | stats values(*) as * by attackId 
+  | eval severity=case(
+      risk_score>=100 OR signature="LOG4J", "critical",
+      risk_score>50 AND risk_score<75, "high",
+      risk_score=0 AND attackOutcome="EXPLOITED", "high",
+      risk_score<=50 AND attackOutcome!="OBSERVED", "medium",
+      risk_score=0 AND attackOutcome="ATTEMPTED", "medium",
+      risk_score=0, "low",
+      risk_score=0 AND attackOutcome="OBSERVED", "low"
+      ) 
+  | eval risk_message=case(
+    (signature="API" OR signature="LOG4J" OR signature="SSRF"), "An attempt to exploit a ".signature." vulnerability was made from a ".src_category." IP address ".src_ip.". The server ".dest_nt_host." hosting application ".app_name." was accessed, and data may have been exfiltrated to ".socketOut.".",
+    (signature="MALIP" OR signature="SQL"), "A vulnerability is being ".attackOutcome." from a ".src_category." IP address ".src_ip.". The server ".dest_nt_host." hosting application ".app_name." was accessed.",
+    (signature="DESEREAL"), "The application ".app_name." deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Data which is untrusted cannot be trusted to be well-formed. Malformed data or unexpected data could be used to abuse application logic, deny service, or execute arbitrary code, when deserialized."
+    )
+  | `cisco_secure_application_alerts_filter`
+how_to_implement: In order to properly run this search, you need to ingest alerts data from AppD SecureApp, specifically ingesting data via HEC. You will also need to ensure that the data is going to sourcetype - `appdynamics_security`. You will need to install the Splunk Add-on for AppDynamics.
+known_false_positives: No known false positives for this detection. If the alerts are noisy, consider tuning this detection by using the _filter macro in this search, and/or updating the tool this alert originates from.
+references:
+- https://docs.appdynamics.com/appd/24.x/latest/en/application-security-monitoring/integrate-cisco-secure-application-with-splunk
+drilldown_searches:
+- name: View the detection results for - "$app_name$"
+  search: '%original_detection_search% | search  app_name = "$app_name$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$app_name$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$app_name$") starthoursago=168  | stats count min(_time)
+    as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
+    as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: $risk_message$
+  risk_objects:
+  - field: app_name
+    type: other
+    score: 10
+  threat_objects:
+  - field: src_ip
+    type: ip_address
+tags:
+  analytic_story:
+  - Critical Alerts
+  asset_type: Web Application
+  mitre_attack_id: []
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: threat
+  # manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Setting these to manual test since otherwise we fail integration testing. The detection is also failing on unit-testing as some of the fields set in the observables are empty.
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/cisco_secure_app_alerts.log
+    sourcetype: appdynamics_security
+    source: AppDynamics Security
@@ -6,7 +6,7 @@ author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: This detection identifies an Active Directory access-control list (ACL)
  modification event, which applies permissions that deny the ability to enumerate
  permissions of the object.
@@ -6,7 +6,7 @@ author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: 'This detection monitors the addition of the following ACLs to an Active
  Directory group object: "Full control", "All extended rights", "All validated writes",  "Create
  all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify
@@ -6,7 +6,7 @@ author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: 'This detection monitors the addition of the following ACLs to an Active
  Directory user object: "Full control","All extended rights","All validated writes",
  "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify
@@ -1,12 +1,12 @@
 name: Windows AD DCShadow Privileges ACL Addition
 id: ae915743-1aa8-4a94-975c-8062ebc8b723
-version: 3
-date: '2025-01-21'
+version: 4
+date: '2025-02-17'
 author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: This detection identifies an Active Directory access-control list (ACL)
  modification event, which applies the minimum required extended rights to perform
  the DCShadow attack.
@@ -6,7 +6,7 @@ author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: ACL deletion performed on the domain root object, significant AD change
  with high impact. Following MS guidance all changes at this level should be reviewed.
  Drill into the logonID within EventCode 4624 for information on the source device
@@ -6,7 +6,7 @@ author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: ACL modification performed on the domain root object, significant AD
  change with high impact. Following MS guidance all changes at this level should
  be reviewed. Drill into the logonID within EventCode 4624 for information on the
@@ -1,12 +1,12 @@
 name: Windows AD GPO Deleted
 id: 0d41772b-35ab-4e1c-a2ba-d0b455481aee
-version: 3
-date: '2025-01-21'
+version: 4
+date: '2025-02-17'
 author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: This detection identifies when an Active Directory Group Policy is deleted
  using the Group Policy Management Console.
 search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=gpLink | eval  ObjectDN=upper(ObjectDN)
@@ -1,12 +1,12 @@
 name: Windows AD GPO Disabled
 id: 72793bc0-c0cd-400e-9e60-fdf36f278917
-version: 3
-date: '2025-01-21'
+version: 4
+date: '2025-02-17'
 author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: This detection identifies when an Active Directory Group Policy is disabled
  using the Group Policy Management Console.
 search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags OperationType="%%14674"
@@ -6,7 +6,7 @@ author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: This detection identifies when a a new client side extension is added
  to an Active Directory Group Policy using the Group Policy Management Console.
 search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames
@@ -6,7 +6,7 @@ author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: This analytic is looking for when an ACL is applied to an OU which denies
  listing the objects residing in the OU. This activity combined with modifying the
  owner of the OU will hide AD objects even from domain administrators.
@@ -6,7 +6,7 @@ author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: AD Object Owner Updated. The owner provides Full control level privileges
  over the target AD Object. This event has significant impact alone and is also a
  precursor activity for hiding an AD object.
@@ -1,12 +1,12 @@
 name: Windows AD Self DACL Assignment
 id: 16132445-da9f-4d03-ad44-56d717dcd67d
-version: 3
-date: '2025-01-21'
+version: 4
+date: '2025-02-17'
 author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: Detect when a user creates a new DACL in AD for their own AD object.
 search: "`wineventlog_security` EventCode=5136  | stats min(_time) as _time values(eval(if(OperationType==\"\
  %%14675\",AttributeValue,null))) as old_value values(eval(if(OperationType==\"%%14674\"\
@@ -6,7 +6,7 @@ author: Dean Luxton
 status: production
 type: TTP
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: 'This detection monitors changes to the following Active Directory attributes:
  "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-KeyCredentialLink",
  "scriptPath", and "msTSInitialProgram".  Modifications to these attributes can indicate
@@ -6,8 +6,8 @@ author: Dean Luxton
 status: experimental
 type: TTP
 data_source:
- Windows Security 5136
- Windows Security 5145
+- Windows Event Log Security 5136
+- Windows Event Log Security 5145
 description: This analytic looks for a the creation of potentially harmful GPO which
  could lead to persistence or code execution on remote hosts. Note, this analyic
  is looking for the absence of the corresponding 5136 events which is evidence of
@@ -0,0 +1,68 @@
+name: O365 Exfiltration via File Access
+id: 80b44ae2-60ff-43f1-8e56-34beb49a340a
+version: 1
+date: '2024-10-14'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic detects when an excessive number of files are access from o365 by the same user over a short period of time. A malicious actor may abuse the "open in app" functionality of SharePoint through scripted or Graph API based access to evade triggering the FileDownloaded Event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be take with any Azure Guest (#EXT#) accounts.
+data_source: 
+- Office 365 Universal Audit Log
+search: |-
+  `o365_management_activity` Operation IN ("fileaccessed") UserId!=app@sharepoint NOT SourceFileExtension IN (bmp,png,jpeg,jpg)
+  | eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
+  | where NOT match(SiteUrl,user_flat)
+  | stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
+  | eventstats avg(count) as avg stdev(count) as stdev by Workload
+  | rename SiteUrl as file_path,Workload as app
+  | where count > 50 AND count > (avg + (3*(stdev))) 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `o365_exfiltration_via_file_access_filter`
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
+known_false_positives: It is possible that certain file access scenarios may trigger this alert, specifically OneDrive syncing and users accessing personal onedrives of other users. Adjust threshold and filtering as needed.
+references:
+- https://attack.mitre.org/techniques/T1567/exfil
+- https://www.varonis.com/blog/sidestepping-detection-while-exfiltrating-sharepoint-data
+- https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/
+drilldown_searches:
+- name: View the detection results for - "$user$"
+  search: '%original_detection_search% | search user = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: Investigate file access by $user$ 
+  search: '`o365_management_activity` Operation IN ("fileaccessed") UserId="$UserId$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: The user $user$ accessed an excessive number of files [$count$] from $file_path$ using $src$
+  risk_objects:
+  - field: user
+    type: user
+    score: 20
+  threat_objects:
+  - field: src
+    type: ip_address
+tags:
+  analytic_story: 
+  - Data Exfiltration
+  - Office 365 Account Takeover
+  asset_type: O365 Tenant  
+  mitre_attack_id: 
+  - T1567
+  - T1530  
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity.log
+    source: o365
+    sourcetype: o365:management:activity
@@ -0,0 +1,66 @@
+name: O365 Exfiltration via File Download
+id: 06b23921-bfe2-4576-89dd-616f06e129da
+version: 1
+date: '2024-10-14'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic detects when an excessive number of files are downloaded from o365 by the same user over a short period of time. O365 may bundle these files together as a ZIP file, however each file will have it's own download event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
+data_source: 
+- Office 365 Universal Audit Log
+search: |-
+  `o365_management_activity` Operation IN ("filedownloaded") 
+  | eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
+  | stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
+  | rename SiteUrl as file_path,Workload as app
+  | where count > 50
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `o365_exfiltration_via_file_download_filter`
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
+known_false_positives: It is possible that certain file download scenarios may trigger this alert, specifically OneDrive syncing. Adjust threshold and filtering as needed.
+references:
+- https://attack.mitre.org/techniques/T1567/exfil
+- https://www.varonis.com/blog/sidestepping-detection-while-exfiltrating-sharepoint-data
+- https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/
+drilldown_searches:
+- name: View the detection results for - "$user$"
+  search: '%original_detection_search% | search user = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: Investigate file downloads by $user$ 
+  search: '`o365_management_activity` Operation IN ("filedownloaded") UserId="$UserId$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: The user $user$ downloaded an excessive number of files [$count$] from $file_path$ using $src$
+  risk_objects:
+  - field: user
+    type: user
+    score: 25
+  threat_objects:
+  - field: src
+    type: ip_address
+tags:
+  analytic_story: 
+  - Data Exfiltration
+  - Office 365 Account Takeover
+  asset_type: O365 Tenant
+  mitre_attack_id: 
+  - T1567
+  - T1530  
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity.log
+    source: o365
+    sourcetype: o365:management:activity
@@ -0,0 +1,67 @@
+name: O365 Exfiltration via File Sync Download
+id: 350837b5-13d3-4c06-b688-db07afbe5050
+version: 1
+date: '2024-10-14'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic detects when an excessive number of files are sync from o365 by the same user over a short period of time. A malicious actor abuse the user-agent string through GUI or API access to evade triggering the FileDownloaded event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
+data_source: 
+- Office 365 Universal Audit Log
+search: |-
+  `o365_management_activity` Operation IN ("filesyncdownload*") UserAgent="*SkyDriveSync*"
+  | eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
+  | where NOT match(SiteUrl,user_flat)
+  | stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
+  | rename SiteUrl as file_path,Workload as app
+  | where count > 50
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `o365_exfiltration_via_file_sync_download_filter`
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
+known_false_positives: It is possible that certain file sync scenarios may trigger this alert, specifically OneNote. Adjust threshold and filtering as needed.
+references:
+- https://attack.mitre.org/techniques/T1567/exfil
+- https://www.varonis.com/blog/sidestepping-detection-while-exfiltrating-sharepoint-data
+- https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/
+drilldown_searches:
+- name: View the detection results for - "$user$"
+  search: '%original_detection_search% | search user = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: Investigate file sync downloads by $user$ 
+  search: '`o365_management_activity` Operation IN ("filesyncdownload*") UserId="$UserId$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: The user $user$ synced an excessive number of files [$count$] from $file_path$ using $src$
+  risk_objects:
+  - field: user
+    type: user
+    score: 25
+  threat_objects:
+  - field: src
+    type: ip_address
+tags:
+  analytic_story: 
+  - Data Exfiltration
+  - Office 365 Account Takeover
+  asset_type: O365 Tenant
+  mitre_attack_id: 
+  - T1567
+  - T1530  
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity.log
+    source: o365
+    sourcetype: o365:management:activity
@@ -4,7 +4,7 @@ version: 2
 date: '2025-02-10'
 author: Dean Luxton
 data_source:
- O365 Add app role assignment grant to user
+- O365 Add app role assignment grant to user.
 type: TTP
 status: production
 description: This detection identifies when an Azure Service Principal elevates privileges
@@ -1,6 +1,6 @@
 name: Detect web traffic to dynamic domain providers
 id: 134da869-e264-4a8f-8d7e-fcd01c18f301
-version: 5
+version: 6
 date: '2024-11-14'
 author: Bhavin Patel, Splunk
 status: deprecated
@@ -9,7 +9,7 @@ description: This search looks for web connections to dynamic DNS providers.
 data_source: []
 search: '| tstats `security_content_summariesonly` count values(Web.url) as url min(_time)
  as firstTime from datamodel=Web where Web.status=200 by Web.src Web.dest Web.status
-  | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `dynamic_dns_web_traffic`
+  | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `dynamic_dns_web_traffic`
  | `detect_web_traffic_to_dynamic_domain_providers_filter`'
 how_to_implement: "This search requires you to be ingesting web-traffic logs. You
  can obtain these logs from indexing data from a web proxy or by using a network-traffic-analysis
@@ -3,9 +3,9 @@ id: 2b85aa3d-f5f6-4c2e-a081-a09f6e1c2e40
 version: 6
 date: '2025-02-10'
 author: Mauricio Velazco, Splunk
-status: production
+status: deprecated
 type: Hunting
-description: The following analytic detects the shutdown of the Windows Event Log
+description: This search has been deprecated in favour of Windows Event Logging Service Has Shutdown . The following analytic detects the shutdown of the Windows Event Log
  service using Windows Event ID 1100. This event is logged every time the service
  stops, including during normal system shutdowns. Monitoring this activity is crucial
  as it can indicate attempts to cover tracks or disable logging. If confirmed malicious,
@@ -14,7 +14,6 @@ description: The following analytic detects suspicious modifications to the Acti
  code upon system startup, potentially leading to further system compromise and unauthorized
  access.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name=
@@ -14,7 +14,6 @@ description: The following analytic detects suspicious modifications to firewall
  leading to further exploitation, data exfiltration, or lateral movement within the
  network.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
@@ -1,6 +1,6 @@
 name: Allow Operation with Consent Admin
 id: 7de17d7a-c9d8-11eb-a812-acde48001122
-version: 8
+version: 9
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
@@ -15,7 +15,6 @@ description: The following analytic detects a registry modification that allows
  administrative access and control over the compromised machine, posing a severe
  security risk.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*"
@@ -15,7 +15,6 @@ description: The following analytic detects a suspicious registry modification t
  their operations, potentially leading to widespread network encryption and data
  loss.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
@@ -1,7 +1,7 @@
 name: CHCP Command Execution
 id: 21d236ec-eec1-11eb-b23e-acde48001122
-version: 4
-date: '2024-11-13'
+version: 5
+date: '2025-02-19'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects the execution of the chcp.exe applic
  system compromise and data exfiltration.
 data_source:
 - Sysmon EventID 1
- Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com
@@ -15,7 +15,6 @@ description: The following analytic detects modifications to the Windows registr
  could allow attackers to execute payloads with minimal alerts, leading to potential
  system compromise and data exfiltration.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
@@ -15,7 +15,6 @@ description: The following analytic detects the modification of Windows Defender
  leading to potential data breaches, system compromise, and further propagation of
  malware within the network.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows
@@ -6,7 +6,6 @@ author: Teoderick Contreras, Splunk, Steven Dick
 status: production
 type: TTP
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 description: The following analytic detects the modification of the Windows registry
  to disable the Windows Defender BlockAtFirstSeen feature. It leverages data from
@@ -14,7 +14,6 @@ description: The following analytic detects the modification of the Windows Defe
  and further system compromise. Immediate investigation and endpoint isolation are
  recommended.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows
@@ -14,7 +14,6 @@ description: The following analytic detects the modification of the registry to
  could enable an attacker to evade detection, maintain persistence, and carry out
  further attacks without being flagged by Windows Defender.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows
@@ -14,7 +14,6 @@ description: The following analytic detects the modification of the Windows regi
  analysis. If confirmed malicious, this could allow an attacker to execute malicious
  code without being detected by Windows Defender, leading to potential system compromise.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows
@@ -14,7 +14,6 @@ description: The following analytic detects modifications to the registry that d
  attackers to execute payloads with minimal alerts, impairing defenses and potentially
  leading to further compromise of the system.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
@@ -15,7 +15,6 @@ description: The following analytic detects modifications to the Windows registr
  could hinder incident response efforts and allow the attacker to maintain control
  over the compromised system.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
@@ -1,6 +1,6 @@
 name: Disable Security Logs Using MiniNt Registry
 id: 39ebdc68-25b9-11ec-aec7-acde48001122
-version: 8
+version: 9
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
@@ -14,7 +14,6 @@ description: The following analytic detects a suspicious registry modification a
  undetected, making it difficult to trace their actions and compromising the integrity
  of security audits.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Control\\MiniNt\\*")
@@ -13,7 +13,6 @@ description: The following analytic detects modifications to the Windows registr
  behavior could allow an attacker to conceal malicious files on the system, making
  it harder for security tools and analysts to identify and remove the threat.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
@@ -14,7 +14,6 @@ description: The following analytic detects the modification of the registry to
  escalation. If confirmed malicious, this could enable an attacker to execute unauthorized
  actions with elevated privileges, compromising the security of the affected system.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentVersion\\Policies\\System*"
@@ -13,7 +13,6 @@ description: The following analytic detects a suspicious registry modification a
  response efforts. If confirmed malicious, this technique can allow an attacker to
  maintain persistence and evade detection, complicating the remediation process.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows
@@ -13,7 +13,6 @@ description: The following analytic identifies modifications in the registry to
  If confirmed malicious, this action could allow an attacker to execute code, escalate
  privileges, or persist in the environment without being detected by antivirus software.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows
@@ -15,7 +15,6 @@ description: The following analytic detects modifications to the Windows registr
  bypass security measures, increasing the risk of successful phishing attacks and
  malware infections.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled",
@@ -14,7 +14,6 @@ description: The following analytic detects modifications to the registry that d
  for directory and file traversal, complicating incident response and allowing the
  attacker to maintain persistence.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD"
@@ -15,7 +15,6 @@ description: The following analytic detects registry modifications that disable
  this could allow attackers to maintain control over the infected machine and prevent
  remediation efforts.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
@@ -14,7 +14,6 @@ description: The following analytic detects the disabling of Windows Defender se
  allow attackers to execute further malicious activities undetected, leading to potential
  data breaches or system compromise.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*"
@@ -15,7 +15,6 @@ description: The following analytic detects the modification of the Windows regi
  If confirmed malicious, this could allow an attacker to hide their presence and
  malicious files, making detection and remediation more difficult.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions"
@@ -13,7 +13,6 @@ description: The following analytic detects the modification of the Windows regi
  malicious, this action could hinder system cleaning efforts and make it more difficult
  to run essential tools, thereby aiding malware persistence.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun"
@@ -14,7 +14,6 @@ description: The following analytic identifies modifications to the registry key
  elevated privileges, making it easier to execute further attacks or maintain persistence
  within the environment.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA*
@@ -1,6 +1,6 @@
 name: Disabling SystemRestore In Registry
 id: f4f837e2-91fb-11eb-8bf6-acde48001122
-version: 9
+version: 10
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
@@ -14,7 +14,6 @@ description: The following analytic detects the modification of registry keys to
  system recovery, allowing the attacker to sustain their foothold and potentially
  cause further damage or data loss.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
@@ -14,7 +14,6 @@ description: The following analytic identifies modifications to the Windows regi
  users from terminating malicious processes. If confirmed malicious, this could allow
  attackers to maintain persistence and control over the infected system.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
@@ -1,6 +1,6 @@
 name: Enable RDP In Other Port Number
 id: 99495452-b899-11eb-96dc-acde48001122
-version: 9
+version: 10
 date: '2024-12-16'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
@@ -14,7 +14,6 @@ description: The following analytic detects modifications to the registry that e
  to bypass network defenses, gain persistent access, and potentially control the
  compromised machine.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Control\\Terminal
@@ -1,6 +1,6 @@
 name: Enable WDigest UseLogonCredential Registry
 id: 0c7d8ffe-25b1-11ec-9f39-acde48001122
-version: 8
+version: 9
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
@@ -14,7 +14,6 @@ description: The following analytic detects a suspicious registry modification t
  If confirmed malicious, this could allow an attacker to obtain sensitive credentials,
  leading to further compromise and lateral movement within the network.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*"
@@ -1,7 +1,7 @@
 name: Exchange PowerShell Abuse via SSRF
 id: 29228ab4-0762-11ec-94aa-acde48001122
-version: 5
-date: '2024-11-13'
+version: 6
+date: '2025-02-19'
 author: Michael Haag, Splunk
 status: experimental
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects suspicious behavior indicative of Pr
  If confirmed malicious, this could lead to unauthorized access, privilege escalation,
  or persistent control over the Exchange environment.
 data_source: []
-search: '`exchange` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST"
+search: '`windows_exchange_iis` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST"
  | stats count min(_time) as firstTime max(_time) as lastTime by dest, cs_uri_query,
  cs_method, c_uri | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `exchange_powershell_abuse_via_ssrf_filter`'
@@ -14,7 +14,6 @@ description: The following analytic detects a suspicious registry modification t
  the attacker to maintain undetected access and control over the system, posing a
  severe security risk.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows
@@ -1,7 +1,7 @@
 name: Jscript Execution Using Cscript App
 id: 002f1e24-146e-11ec-a470-acde48001122
-version: 5
-date: '2025-02-10'
+version: 6
+date: '2025-02-19'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -14,7 +14,6 @@ description: The following analytic detects the execution of JScript using the c
  scripts, leading to code execution, data exfiltration, or further system compromise.
 data_source:
 - Sysmon EventID 1
- Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
@@ -13,7 +13,6 @@ description: The following analytic detects modifications to the registry key `H
  this could allow attackers to maintain persistence, execute code with high privileges,
  and potentially compromise the entire system.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND
@@ -14,7 +14,6 @@ description: The following analytic detects modifications to the registry aimed
  If confirmed malicious, this could allow an attacker to execute arbitrary code with
  elevated privileges, compromising system integrity.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH"
@@ -1,7 +1,7 @@
 name: Ping Sleep Batch Command
 id: ce058d6c-79f2-11ec-b476-acde48001122
-version: 6
-date: '2025-02-10'
+version: 7
+date: '2025-02-19'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -15,7 +15,6 @@ description: The following analytic identifies the execution of ping sleep batch
  exfiltration.
 data_source:
 - Sysmon EventID 1
- Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where `process_ping` (Processes.parent_process
@@ -0,0 +1,62 @@
+name: Potential Telegram API Request Via CommandLine
+id: d6b0d627-d0bf-46b1-936f-c48284767d21
+version: 1
+date: '2025-02-19'
+author: Nasreddine Bencherchali, Splunk, Zaki Zarkasih Al Mustafa
+status: production
+type: Anomaly
+description: The following analytic detects the presence of "api.telegram.org" in the CommandLine of a process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity can be significant as the telegram API has been used as an exfiltration mechanism or even as a C2 channel. If confirmed malicious, this could allow an attacker or malware to exfiltrate data or receive additional C2 instruction, potentially leading to further compromise and persistence within the network.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process= "*api.telegram.org*" NOT Processes.process IN ("*-osint -url*", "* --single-argument*") by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_id Processes.process_name Processes.process Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `potential_telegram_api_request_via_commandline_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: False positive may stem from application or users requesting the API directly via CommandLine for testing purposes. Investigate the matches and apply the necessary filters.
+references:
+- https://www.virustotal.com/gui/file/0b3ef5e04329cefb5bb4bf30b3edcb32d1ec6bbcb29d22695a079bfb5b56e8ac/behavior
+- https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/behavior
+- https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/content
+- https://www.virustotal.com/gui/file/1c4541bf70b6e251ef024ec4dde8dce400539c2368461c0d90e15a81b11ace44/content
+drilldown_searches:
+- name: View the detection results for - "$dest$"
+  search: '%original_detection_search% | search  dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Process $process_name$ with command line $process$ in $dest$
+  risk_objects:
+  - field: dest
+    type: system
+    score: 30
+  threat_objects:
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - XMRig
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1102.002
+  - T1041
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: 
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -13,7 +13,6 @@ description: The following analytic detects suspicious modifications or new entr
  this could allow an attacker to execute a malicious DLL payload by restarting the
  spoolsv.exe process, leading to potential control over the compromised machine.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
@@ -14,7 +14,6 @@ description: The following analytic detects registry activity related to the cre
  manipulate application behavior, posing a severe risk to the integrity and security
  of the affected systems.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom*
@@ -15,7 +15,6 @@ description: The following analytic identifies modifications to registry keys co
  control over compromised systems, posing a severe threat to system integrity and
  security.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
@@ -14,7 +14,6 @@ description: The following analytic detects modifications to registry keys under
  attackers to execute arbitrary code with elevated privileges, leading to potential
  system compromise and persistent access.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path="*Microsoft\\Windows
@@ -14,7 +14,6 @@ description: The following analytic detects modifications to the SCRNSAVE.EXE re
  attacker to execute arbitrary code with elevated privileges, leading to further
  system compromise and persistent access.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
  max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control
@@ -14,7 +14,6 @@ description: The following analytic detects suspicious modifications to the time
  automatically upon system boot, potentially leading to further exploitation and
  control over the affected system.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*")
@@ -1,7 +1,7 @@
 name: Vbscript Execution Using Wscript App
 id: 35159940-228f-11ec-8a49-acde48001122
-version: 5
-date: '2025-02-10'
+version: 6
+date: '2025-02-19'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects the execution of VBScript using the
  data exfiltration, or further lateral movement within the network.
 data_source:
 - Sysmon EventID 1
- Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
@@ -1,7 +1,7 @@
 name: Windows AD Domain Controller Audit Policy Disabled
 id: fc3ccef1-60a4-4239-bd66-b279511b4d14
-version: 4
-date: '2024-11-13'
+version: 5
+date: '2025-01-28'
 author: Dean Luxton
 type: TTP
 status: production
@@ -53,7 +53,7 @@ rba:
  threat_objects: []
 tags:
  analytic_story:
-  - Sneaky Active Directory Persistence Tricks
+  - Windows Audit Policy Tampering
  asset_type: Endpoint
  mitre_attack_id:
  - T1562.001
@@ -6,7 +6,7 @@ author: Dean Luxton
 type: TTP
 status: production
 data_source:
- Windows Security 5136
+- Windows Event Log Security 5136
 description: The following analytic detects the addition of permissions required for
  a DCSync attack, specifically DS-Replication-Get-Changes, DS-Replication-Get-Changes-All,
  and DS-Replication-Get-Changes-In-Filtered-Set. It leverages EventCode 5136 from
@@ -1,10 +1,10 @@
 name: Windows Archived Collected Data In TEMP Folder
 id: cb56a1ea-e0b1-46d5-913f-e024cba40cbe
-version: 2
-date: '2024-11-13'
+version: 3
+date: '2025-02-17'
 author: Teoderick Contreras, Splunk
 data_source:
- Sysmon Event ID 11
+- Sysmon EventID 11
 type: TTP
 status: production
 description: The following analytic detects the creation of archived files in a temporary
@@ -0,0 +1,62 @@
+name: Windows Audit Policy Auditing Option Disabled via Auditpol
+id: 663a7a50-b752-4c84-975b-8325ca3f6f9e
+version: 1
+date: '2025-01-27'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: TTP
+description: The following analytic identifies the execution of `auditpol.exe` with the "/set", "/option" and "/value:disable" command-line arguments used to disable specific auditing options of the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_auditpol` Processes.process="*/set*" Processes.process="*/option:*" Processes.process="*/value:disable*" Processes.process IN ("*FullPrivilegeAuditing*", "*AuditBaseObjects*", "*AuditBaseDirectories*") by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_auditing_option_disabled_via_auditpol_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: None identified. Attempts to disable logging should be identified and understood.
+references:
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpac/262a2bed-93d4-4c04-abec-cf06e9ec72fd
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
+    "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable an audit policy auditing option on endpoint $dest$ by user $user$.
+  risk_objects:
+  - field: user
+    type: user
+    score: 60
+  - field: dest
+    type: system
+    score: 60
+  threat_objects:
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - Windows Audit Policy Tampering
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1562.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test - Sysmon
+  attack_data:
+  - data: 
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,58 @@
+name: Windows Audit Policy Auditing Option Modified - Registry
+id: 27914692-9c62-44ea-9129-ceb429b61bd0
+version: 1
+date: '2025-01-27'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects potentially suspicious modifications to the Audit Policy auditing options registry values. It leverages data from the Endpoint.Registry data model, focusing on changes to one of the following auditing option values "CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects" and "AuditBaseDirectories" within the "HKLM\\System\\CurrentControlSet\\Control\\Lsa\\" registry key. This activity is significant as it could be a sign of a threat actor trying to tamper with the audit policy configuration, and disabling SACLs configuration. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
+data_source:
+- Sysmon EventID 13
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_key_name="*\\Control\\Lsa" Registry.registry_value_name IN ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects", "AuditBaseDirectories") BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_auditing_option_modified___registry_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
+known_false_positives: Active setup installer may add or modify this registry.
+references:
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpac/262a2bed-93d4-4c04-abec-cf06e9ec72fd
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
+drilldown_searches:
+- name: View the detection results for - "$dest$" and "$user$"
+  search: '%original_detection_search% | search  dest = "$dest$" user = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$" and "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
+    "$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: The auditing option $registry_value_name$ from the configured Audit Policy was modified on $dest$.
+  risk_objects:
+  - field: dest
+    type: system
+    score: 64
+  - field: user
+    type: user
+    score: 64
+  threat_objects: []
+tags:
+  analytic_story:
+  - Windows Audit Policy Tampering
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1547.014
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test - Sysmon
+  attack_data:
+  - data: 
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,71 @@
+name: Windows Audit Policy Cleared via Auditpol
+id: f067f7cf-f41b-4a60-985e-c23e268a13cb
+version: 1
+date: '2025-01-27'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: TTP
+description: The following analytic identifies the execution of `auditpol.exe` with the "/clear" command-line argument used to clears the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_auditpol` Processes.process IN ("*/clear*", "*/remove*") AND NOT Processes.process IN ("*/resourceSACL*", "*/?*") by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_cleared_via_auditpol_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: None identified. Attempts to disable logging should be identified and understood.
+references:
+- https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+- https://www.cybereason.com/blog/research/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities
+- https://attack.mitre.org/techniques/T1562/002/
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-clear
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-remove
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
+    "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to clear logging on endpoint $dest$ by user $user$.
+  risk_objects:
+  - field: user
+    type: user
+    score: 16
+  - field: dest
+    type: system
+    score: 16
+  threat_objects:
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - Windows Audit Policy Tampering
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1562.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test - Sysmon
+  attack_data:
+  - data: 
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
+- name: True Positive Test - Security
+  attack_data:
+  - data: 
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,64 @@
+name: Windows Audit Policy Disabled via Auditpol
+id: 14e008e5-6723-4298-b0d4-e95b24e10c18
+version: 1
+date: '2025-01-27'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: The following analytic identifies the execution of `auditpol.exe` with the "/set" command-line argument in order to disable a specific category or sub-category from the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_auditpol` Processes.process="*/set*" Processes.process IN ("*/success:*", "*/failure:*") Processes.process="*disable*" AND NOT Processes.process IN ("*/?*", "*/exclude*") by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_disabled_via_auditpol_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: False positives should be rare, investigate the activity, and apply additional filters when necessary.
+references:
+- https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+- https://www.cybereason.com/blog/research/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities
+- https://attack.mitre.org/techniques/T1562/002/
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
+    "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: An instance of $parent_process_name$ spawning $process_name$ with CommandLine $process$ was identified attempting to disable and audit policy category/sub-category on $dest$ by user $user$.
+  risk_objects:
+  - field: user
+    type: user
+    score: 25
+  - field: dest
+    type: system
+    score: 25
+  threat_objects:
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - Windows Audit Policy Tampering
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1562.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test - Sysmon
+  attack_data:
+  - data: 
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,64 @@
+name: Windows Audit Policy Disabled via Legacy Auditpol
+id: d2cef287-c2b7-4496-a609-7a548c1e27f9
+version: 1
+date: '2025-01-27'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: The following analytic identifies the execution of the legacy `auditpol.exe` included with the Windows 2000 Resource Kit Tools, with the "/disable" command-line argument or one of the allowed category flags and the "none" option, in order to disable a specific logging category from the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (`process_auditpol` Processes.process="*/disable") OR Processes.process IN ("*/system:none*", "*/logon:none*", "*/object:none*", "*/privilege:none*", "*/process:none*", "*/policy:none*", "*/sam:none*") by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_disabled_via_legacy_auditpol_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: False positives should be rare, investigate the activity, and apply additional filters when necessary.
+references:
+- https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+- https://www.cybereason.com/blog/research/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities
+- https://attack.mitre.org/techniques/T1562/002/
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
+    "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: An instance of $parent_process_name$ spawning $process_name$ with CommandLine $process$ was identified attempting to disable and audit policy category/sub-category on $dest$ by user $user$.
+  risk_objects:
+  - field: user
+    type: user
+    score: 25
+  - field: dest
+    type: system
+    score: 25
+  threat_objects:
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - Windows Audit Policy Tampering
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1562.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test - Sysmon
+  attack_data:
+  - data: 
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,70 @@
+name: Windows Audit Policy Excluded Category via Auditpol
+id: 083708d4-d763-4ba2-87ac-105b526de81a
+version: 1
+date: '2025-01-27'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: The following analytic identifies the execution of `auditpol.exe` with the "/set" and "/exclude" command-line arguments which indicates that the user's per-user policy will cause audit to be suppressed regardless of the system audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to exclude specific users events from log data. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_auditpol` Processes.process="*/set*" Processes.process="*/exclude*" AND NOT Processes.process="*/?*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_excluded_category_via_auditpol_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: False positives should be rare, investigate the activity, and apply additional filters when necessary.
+references:
+- https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+- https://www.cybereason.com/blog/research/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities
+- https://attack.mitre.org/techniques/T1562/002/
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
+    "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: An instance of $parent_process_name$ spawning $process_name$ with CommandLine $process$ was identified attempting to exclude a specific user events on $dest$ by user $user$.
+  risk_objects:
+  - field: user
+    type: user
+    score: 25
+  - field: dest
+    type: system
+    score: 25
+  threat_objects:
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - Windows Audit Policy Tampering
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1562.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test - Sysmon
+  attack_data:
+  - data: 
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
+- name: True Positive Test - Security
+  attack_data:
+  - data: 
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,64 @@
+name: Windows Audit Policy Restored via Auditpol
+id: d7d1795b-ea18-47e5-9ca6-2c330d052d21
+version: 1
+date: '2025-01-27'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: The following analytic identifies the execution of `auditpol.exe` with the "/restore" command-line argument used to restore the audit policy from a file. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. Attackers can provide an audit policy file that disables certain or all audit policy configuration. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_auditpol` Processes.process="*/restore*" Processes.process="*/file*" AND NOT Processes.process="*/?*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_restored_via_auditpol_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: False positives could arise from administrative activity such as audit policy setup. Apply additional filters to known scripts and parent processes performing this action where necessary.
+references:
+- https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+- https://www.cybereason.com/blog/research/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities
+- https://attack.mitre.org/techniques/T1562/002/
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-restore
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
+    "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to restore and audit policy on endpoint $dest$ by user $user$.
+  risk_objects:
+  - field: user
+    type: user
+    score: 16
+  - field: dest
+    type: system
+    score: 16
+  threat_objects:
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - Windows Audit Policy Tampering
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1562.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test - Sysmon
+  attack_data:
+  - data: 
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,61 @@
+name: Windows Audit Policy Security Descriptor Tampering via Auditpol
+id: 5628e0b7-73dc-4f1b-b37a-6e68efc2225f
+version: 1
+date: '2025-01-27'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: The following analytic identifies the execution of `auditpol.exe` with the "/set" flag, and "/sd" command-line arguments used to modify the security descriptor of the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. An attacker, can disable certain policy categories from logging and then change the security descriptor in order to restrict access to certain users or application from reverting their changes. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_auditpol` Processes.process="*/set*" Processes.process="*/sd:*" AND NOT Processes.process="*/?*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_security_descriptor_tampering_via_auditpol_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: False positives should be rare to non existent. Any activity detected by this analytic should be investigated and approved or denied.
+references:
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
+    "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: An instance of $parent_process_name$ spawning $process_name$ with commandline $process$ was identified attempting to modify the audit policy security descriptor on endpoint $dest$ by user $user$.
+  risk_objects:
+  - field: user
+    type: user
+    score: 16
+  - field: dest
+    type: system
+    score: 16
+  threat_objects:
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - Windows Audit Policy Tampering
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1562.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test - Sysmon
+  attack_data:
+  - data: 
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -1,6 +1,6 @@
 name: Windows Autostart Execution LSASS Driver Registry Modification
 id: 57fb8656-141e-4d8a-9f51-62cff4ecb82a
-version: 4
+version: 5
 date: '2024-11-13'
 author: Michael Haag, Splunk
 status: production
@@ -14,7 +14,6 @@ description: The following analytic detects modifications to undocumented regist
  malicious, this could allow attackers to gain unauthorized access to sensitive information
  and escalate privileges within the environment.
 data_source:
- Sysmon EventID 12
 - Sysmon EventID 13
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt","*\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt")
@@ -0,0 +1,69 @@
+name: Windows BitLocker Suspicious Command Usage
+id: d0e6ec70-6e40-41a2-8b93-8d9ff077a746
+version: 1
+date: '2025-02-10'
+author: Steven Dick
+status: production
+type: TTP
+description: This analytic is developed to detect the usage of BitLocker commands used to disable or impact boot settings. The malware ShrinkLocker uses various commands change how BitLocker handles encryption, potentially bypassing TPM requirements, enabling BitLocker without TPM, and enforcing specific startup key and PIN configurations. Such modifications can weaken system security, making it easier for unauthorized access and data breaches. Detecting these changes is crucial for maintaining robust encryption and data protection.
+data_source: 
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: |-
+  | tstats `security_content_summariesonly` values(Processes.process) as process, values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = manage-bde.exe AND Processes.process IN ("* -protectors -disable *","* -protectors -delete *","* –forcerecovery *","* -lock *") by Processes.dest Processes.user Processes.process_name Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_bitlocker_suspicious_command_usage_filter`
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
+references:
+- https://attack.mitre.org/techniques/T1486/
+- https://www.nccgroup.com/us/research-blog/nameless-and-shameless-ransomware-encryption-via-bitlocker/
+- https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
+- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
+drilldown_searches:
+- name: View the detection results for - "$dest$" and "$user$"
+  search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$" and "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: Investigate processes on $dest$ 
+  search: '| from datamodel Endpoint.Processes
+| search process_name = $process_name$ AND dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: A suspicious Windows BitLocker command was run by $user$ detected on $dest$
+  risk_objects: 
+  - field: dest
+    type: system
+    score: 60
+  - field: user
+    type: user
+    score: 60
+  threat_objects: 
+  - field: parent_process
+    type: process
+tags:
+  analytic_story: 
+  - ShrinkLocker
+  asset_type: Endpoint
+  mitre_attack_id: 
+  - T1486
+  - T1490
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/bitlocker_sus_commands/bitlocker_sus_commands.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -1,10 +1,10 @@
 name: Windows BitLockerToGo with Network Activity
 id: 14e3a089-cc23-4f4d-a770-26e44a31fbac
-version: 2
-date: '2025-01-21'
+version: 3
+date: '2025-02-17'
 author: Michael Haag, Nasreddine Bencherchali, Splunk
 data_source:
- Sysmon Event ID 22
+- Sysmon EventID 22
 type: Hunting
 status: production
 description: The following analytic detects suspicious usage of BitLockerToGo.exe,
@@ -0,0 +1,58 @@
+name: Windows Cisco Secure Endpoint Related Service Stopped
+id: df74f45f-01c8-4fd6-bcb8-f6a9ea58307a
+version: 1
+date: '2024-12-09'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
+data_source:
+- Windows Event Log System 7036
+search: '`wineventlog_system` `normalized_service_binary_field` | rename param1 as display_name | rename param2 as status | search EventCode=7036 display_name IN ("Cisco AMP Orbital", "*Cisco Secure Endpoint*", "*Cisco Security Connector Monitoring*", "CiscoSAM", "CiscoAMPHeurDriver", "CiscoAMPELAMDriver", "CiscoAMPCEFWDriver", "ImmunetNetworkMonitorDriver", "ImmunetProtectDriver", "ImmunetSelfProtectDriver") status IN ("stopped", "arrêté") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode display_name normalized_service_name status dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_cisco_secure_endpoint_related_service_stopped_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints.
+known_false_positives: Administrator or troubleshooting activities may trigger this alert. Investigate the process performing this action to determine if its a legitimate activity.
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
+- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
+- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
+drilldown_searches:
+- name: View the detection results for - "$dest$"
+  search: '%original_detection_search% | search  dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Cisco Secure Endpoint Service $display_name$ stopped on $dest$
+  risk_objects:
+  - field: dest
+    type: system
+    score: 60
+  threat_objects:
+  - field: display_name
+    type: service
+tags:
+  analytic_story:
+  - Security Solution Tampering
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1490
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/service_stop.log
+    source: XmlWinEventLog:System
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,57 @@
+name: Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc
+id: 44badcb1-2e8c-4628-9537-021bbae571ad
+version: 1
+date: '2025-02-19'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects the use of the `sfc.exe` utility, in order to stop the Immunet Protect service. The Sfc.exe utility is part of Cisco Secure Endpoint installation. This detection leverages telemetry from the endpoint, focusing on command-line executions involving the `-k` parameter. This activity is significant as it indicates potential tampering with defensive mechanisms. If confirmed malicious, attackers could partially blind the EDR, enabling further compromise and lateral movement within the network.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -k*" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_stop_immunet_service_via_sfc_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis.
+references:
+- https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213690-amp-for-endpoint-command-line-switches.html
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Suspicious use of `sfc.exe` stopping the Immunet Protect service on $dest$ by user $user$.
+  risk_objects:
+  - field: user
+    type: user
+    score: 56
+  - field: dest
+    type: system
+    score: 56
+  threat_objects:
+  - field: parent_process_name
+    type: parent_process_name
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - Security Solution Tampering
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/sfc_tampering.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,57 @@
+name: Windows Cisco Secure Endpoint Unblock File Via Sfc
+id: 9a7a490c-5581-4c95-bab5-a21e351293ef
+version: 1
+date: '2025-02-19'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects the use of the sfc.exe utility with the "-unblock" parameter, a feature within Cisco Secure Endpoint. The "-unblock" flag is used to remove system blocks imposed by the endpoint protection. This detection focuses on command-line activity that includes the "-unblock" parameter, as it may indicate an attempt to restore access to files or processes previously blocked by the security software. While this action could be legitimate in troubleshooting scenarios, malicious actors might use it to override protective measures, enabling execution of blocked malicious payloads or bypassing other security mechanisms.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -unblock *" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_unblock_file_via_sfc_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis.
+references:
+- https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213690-amp-for-endpoint-command-line-switches.html
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Suspicious use of `sfc.exe` unblocking a potentially harmful file on $dest$ by user $user$
+  risk_objects:
+  - field: user
+    type: user
+    score: 56
+  - field: dest
+    type: system
+    score: 56
+  threat_objects:
+  - field: parent_process_name
+    type: parent_process_name
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - Security Solution Tampering
+  asset_type: Endpoint 
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/sfc_tampering.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,57 @@
+name: Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc
+id: ba6e7f4d-a85e-4a14-8e7d-41f4b82e3c9a
+version: 1
+date: '2025-02-19'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects the use of the sfc.exe utility with the "-u" parameter, which is part of the Cisco Secure Endpoint installation. The "-u" flag allows the uninstallation of Cisco Secure Endpoint components. This detection leverages endpoint telemetry to monitor command-line executions that include the "-u" parameter. The use of this flag is significant as it could indicate an attempt to disable or remove endpoint protection, potentially leaving the system vulnerable to further exploitation. If identified as malicious, this action may be part of a broader effort to disable security mechanisms and avoid detection.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -u*" NOT Processes.process="* -unblock *" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis.
+references:
+- https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213690-amp-for-endpoint-command-line-switches.html
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Suspicious use of `sfc.exe` to uninstall the Immunet Protect service on $dest$ by user $user$.
+  risk_objects:
+  - field: user
+    type: user
+    score: 56
+  - field: dest
+    type: system
+    score: 56
+  threat_objects:
+  - field: parent_process_name
+    type: parent_process_name
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - Security Solution Tampering
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/sfc_tampering.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -1,7 +1,7 @@
 name: Windows Command Shell DCRat ForkBomb Payload
 id: 2bb1a362-7aa8-444a-92ed-1987e8da83e1
-version: 6
-date: '2025-02-10'
+version: 7
+date: '2025-02-19'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects the execution of a DCRat "forkbomb"
  disruption of services.
 data_source:
 - Sysmon EventID 1
- Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
  values(Processes.parent_process) as parent_process values(Processes.parent_process_id)
@@ -0,0 +1,65 @@
+name: Windows Compatibility Telemetry Suspicious Child Process
+id: 56fe46ca-ffef-46fe-8f0e-5cd4b7b4cc0c
+version: 1
+date: '2025-02-13'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic detects the execution of CompatTelRunner.exe with parameters indicative of a process not part of the normal "Microsoft Compatibility Appraiser" telemetry collection. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line arguments. This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" task always run as System and can be used to elevate privileges or establish a highly privileged persistence mechanism. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system.
+data_source: 
+- Windows Security Event ID 4688
+- Sysmon Event ID 1
+- CrowdStrike ProcessRollup2
+search: |-
+  |  tstats `security_content_summariesonly` values(Processes.parent_process) as Processes.parent_process, values(Processes.process) as Processes.process values(Processes.process_current_directory) AS process_current_directory, values(Processes.process_id) as Processes.process_id, values(Processes.process_guid) as Processes.process_guid, count min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name = "CompatTelRunner.exe" AND Processes.process="* -cv:*" NOT Processes.process IN ("* -m:*") BY _time span=1h Processes.user Processes.dest Processes.parent_process_name Processes.process_name
+  |`drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_compatibility_telemetry_suspicious_child_process_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: None identified
+references:
+- https://attack.mitre.org/techniques/T1546/
+- https://scythe.io/threat-thursday/windows-telemetry-persistence
+- https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence
+drilldown_searches:
+- name: View the detection results for - "$dest$"
+  search: '%original_detection_search% | search dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: Investigate processes on $dest$ 
+  search: '| from datamodel Endpoint.Processes
+| search dest = "$dest$" AND process_name = "$process_name$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: The process $process_name$ was launched in a suspicious manner by $parent_process_name$ on host $dest$
+  risk_objects: 
+  - field: dest
+    type: system
+    score: 70
+  threat_objects: 
+  - field: process_name
+    type: process
+tags:
+  analytic_story: 
+  - Windows Persistence Techniques
+  asset_type: Endpoint
+  mitre_attack_id: 
+  - T1546
+  - T1053.005
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/compattelrunner_abuse/compattelrunner_abuse.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,67 @@
+name: Windows Compatibility Telemetry Tampering Through Registry
+id: 43834687-cc48-4878-a2fa-f76e4271791f
+version: 1
+date: '2025-02-13'
+author: Steven Dick
+status: production
+type: TTP
+description: This detection identifies suspicious modifications to the Windows Compatibility Telemetry registry settings, specifically within the "TelemetryController" registry key and "Command" registry value. It leverages data from the Endpoint.Registry data model, focusing on registry paths and values indicative of such changes. This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" task always run as System and can be used to elevate privileges or establish a highly privileged persistence mechanism. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system.
+data_source: 
+- Sysmon Event ID 13
+search: |-
+  | tstats `security_content_summariesonly` min(_time) as firstTime, max(_time) as lastTime, count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController*" AND Registry.registry_value_name="Command" NOT Registry.registry_value_data IN ("(empty)")) BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)`
+  | eval process = registry_value_data 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_compatibility_telemetry_tampering_through_registry_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: None identified
+references:
+- https://attack.mitre.org/techniques/T1546/
+- https://scythe.io/threat-thursday/windows-telemetry-persistence
+- https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence
+drilldown_searches:
+- name: View the detection results for - "$dest$" and "$user$"
+  search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$" and "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$","$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: Investigate registry changes on $dest$ 
+  search: '| from datamodel Endpoint.Registry
+| search registry_path = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController*" AND dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: The process $process$ was added to registry settings for the Compatibility Appraiser by $user$ on host $dest$
+  risk_objects: 
+  - field: dest
+    type: system
+    score: 70
+  - field: user
+    type: user
+    score: 70
+  threat_objects: 
+  - field: process
+    type: process
+tags:
+  analytic_story: 
+  - Windows Persistence Techniques
+  asset_type: Endpoint
+  mitre_attack_id: 
+  - T1546
+  - T1053.005
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/compattelrunner_abuse/compattelrunner_abuse.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
--- a/Show More
+++ b/Show More