Merge branch 'TR_1550_Kerberos_Coverage_2' of github.com:splunk/security_content into TR_1550_Kerberos_Coverage_2

.github/workflows/build-and-validate.yml

@@ -455,13 +455,15 @@ jobs:
           source venv/bin/activate
           python3 bin/doc_gen.py --path . --output docs -v
 
-      - name: Enrich detections with TAs
-        env:
-          GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_ACCESS_TOKEN }}
-        run: |
-          source venv/bin/activate
-          python3 -m pip install security_content_automation/requirements.txt
-          python3 security_content_automation/enrich_detections.py
+      # this step is creating some TOKEN issues while tagging a build, commenting this out for now
+      
+      # - name: Enrich detections with TAs
+      #   env:
+      #     GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      #   run: |
+      #     source venv/bin/activate
+      #     python3 -m pip install -r security_content_automation/requirements.txt
+      #     python3 security_content_automation/enrich_detections.py
 
       - name: Make YAMLs Pretty
         run: |

.github/workflows/detection-testing.yml

@@ -50,6 +50,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
+          with:
+            ref: develop
         
       
 
@@ -137,6 +139,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
+          with:
+            ref: develop
         
         - name: Download artifacts
           uses: actions/download-artifact@v2
@@ -194,6 +198,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
+          with:
+            ref: develop
         
         - name: Download artifacts
           uses: actions/download-artifact@v2

.gitignore

@@ -115,3 +115,10 @@ package/bin/sftp-config.json
 package/default/sftp-config.json
 *.code-snippets
 notes
+
+# detection_testing_batch innteractive mode
+bin/automated_detection_testing/ci/detection_testing_batch/*-test-run.json
+bin/automated_detection_testing/ci/detection_testing_batch/apps/
+bin/automated_detection_testing/ci/detection_testing_batch/security_content/
+bin/automated_detection_testing/ci/detection_testing_batch/test_config.json
+bin/automated_detection_testing/ci/detection_testing_batch/test_results/

detections/cloud/aws_lambda_updatefunctioncode.yml

@@ -0,0 +1,68 @@
+name: AWS Lambda UpdateFunctionCode
+id: 211b80d3-6340-4345-11ad-212bf3d0d111
+version: 1
+date: '2022-02-24'
+author: Bhavin Patel, Splunk
+type: Hunting
+datamodel: []
+description: This analytic is designed to detect IAM users attempting to update/modify
+  AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS
+  environment and to facilitate planting backdoors. In this instance, an attacker
+  may upload malicious code/binary to a lambda function which will be executed automatically
+  when the funnction is triggered.
+search: '`cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode*  errorCode
+  = success  user_type=IAMUser | stats  count min(_time) as firstTime max(_time) as
+  lastTime  values(requestParameters.functionName) as function_updated by src_ip user_arn
+  user_agent user_type eventName aws_account_id |`aws_lambda_updatefunctioncode_filter`'
+how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in
+  your AWS Environment.
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
+references:
+- http://detectioninthe.cloud/execution/modify_lambda_function_code/
+- https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/
+tags:
+  analytic_story:
+  - Suspicious Cloud User Activities
+  asset_type: AWS Account
+  automated_detection_testing: passed
+  cis20:
+  - CIS 13
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Outcome:Allowed
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events.json
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: User $user_arn$ is attempting to update the lambda function code of $function_updated$
+    from this IP $src_ip$
+  mitre_attack_id:
+  - T1204
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  risk_score: 63
+  security_domain: cloud

detections/cloud/o365_excessive_authentication_failures_alert.yml

@@ -7,12 +7,11 @@ type: Anomaly
 datamodel: []
 description: This search detects when an excessive number of authentication failures
   occur this search also includes attempts against MFA prompt codes
-search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
-  | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod 
-  values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
-  | where count > 10 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
+search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=*
+  status=failure | stats count earliest(_time) AS firstTime latest(_time) AS lastTime
+  values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS
+  UserAgent values(status) AS status values(src_ip) AS src_ip by user | where count
+  > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `o365_excessive_authentication_failures_alert_filter`'
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
   works with o365:management:activity

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -33,6 +33,7 @@ tags:
   - IcedID
   - Log4Shell CVE-2021-44228
   - WhisperGate
+  - Hermetic Wiper
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/detect_regasm_with_network_connection.yml

@@ -15,12 +15,10 @@ description: The following analytic identifies regasm.exe with a network connect
   and review accordingly. Review the reputation of the remote IP or domain and block
   as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regasm.exe 
-  | rename Computer as dest 
-  | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `detect_regasm_with_network_connection_filter`'
+search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
+  process_name=regasm.exe | rename Computer as dest | stats count min(_time) as firstTime
+  max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/detect_regsvcs_with_network_connection.yml

@@ -15,12 +15,10 @@ description: The following analytic identifies Regsvcs.exe with a network connec
   and review accordingly. Review the reputation of the remote IP or domain and block
   as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe 
-  | rename Computer as dest 
-  | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `detect_regsvcs_with_network_connection_filter`'
+search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
+  process_name=regsvcs.exe | rename Computer as dest | stats count min(_time) as firstTime
+  max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml

@@ -6,18 +6,21 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser`
-  is part of the Active Directory PowerShell module used to manage Windows Active Directory networks.
-  As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser 
-  allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
-  Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline.
+  to identify the execution of the `Get-ADUser` commandlet with specific parameters.
+  `Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows
+  Active Directory networks. As the name suggests, `Get-ADUser` is used to query for
+  domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover
+  domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries
+  alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack
+  their passwords offline.
 search: ' `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*")
-  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
-  | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes.
+known_false_positives: Administrators or power users may use search for accounts with
+  Kerberos Pre Authentication disabled for legitimate purposes.
 references:
 - https://attack.mitre.org/techniques/T1558/004/
 - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
@@ -25,17 +28,20 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
+  impact: 60
   kill_chain_phases:
   - Privilege Escalation
+  message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$
   mitre_attack_id:
   - T1558
   - T1558.004
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
   observable:
   - name: dest
     type: Endpoint
@@ -51,12 +57,5 @@ tags:
   - Message
   - ComputerName
   - User
-  security_domain: endpoint
-  impact: 60
-  confidence: 90 
   risk_score: 54
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  - Stage:Recon
-  message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$
+  security_domain: endpoint

detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml

@@ -6,14 +6,16 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser`
-  is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks.
-  As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired`
-  allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
-  Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline.
+  to identify the execution of the `Get-DomainUser` commandlet with specific parameters.
+  `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration
+  on Windows Active Directory networks. As the name suggests, `Get-DomainUser` is
+  used to identify domain users and combining it with `-PreauthNotRequired` allows
+  adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
+  Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts
+  and attempt to crack their passwords offline.
 search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*")
-  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
-  | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -25,10 +27,17 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
+  impact: 60
   kill_chain_phases:
   - Privilege Escalation
+  message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$
   mitre_attack_id:
   - T1558
   - T1558.004
@@ -47,12 +56,5 @@ tags:
   - Message
   - ComputerName
   - User
-  security_domain: endpoint
-  impact: 60
-  confidence: 90 
   risk_score: 54
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  - Stage:Recon
-  message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$
+  security_domain: endpoint

detections/endpoint/eventvwr_uac_bypass.yml

@@ -40,6 +40,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - IcedID
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml

@@ -1,8 +1,8 @@
 name: Excessive number of distinct processes created in Windows Temp folder
 id: 23587b6a-c479-11eb-b671-acde48001122
-version: 1
-date: '2021-06-03'
-author: Michael Hart, Splunk
+version: 2
+date: '2022-02-28'
+author: Michael Hart, Mauricio Velazco, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
@@ -13,7 +13,7 @@ description: This analytic will identify suspicious series of process executions
   to typical application behaviors that use Windows\Temp.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   distinct_count(Processes.process) as distinct_process_count  min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path
   = "*\\Windows\\Temp\\*" by Processes.dest Processes.user  _time span=20m | where
   distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter`'

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Active Directory Lateral Movement
   - Trickbot
+  - Hermetic Wiper
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -38,6 +38,7 @@ tags:
   - XMRig
   - Remcos
   - WhisperGate
+  - Hermetic Wiper
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml

@@ -10,10 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams
   and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement
   and remote code execution.
-search: '`powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*") 
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
-  | `security_content_ctime(firstTime)` 
-  | `interactive_session_on_remote_endpoint_with_powershell_filter`'
+search: '`powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `interactive_session_on_remote_endpoint_with_powershell_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
   can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.

detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml

@@ -5,19 +5,24 @@ date: '2022-02-09'
 author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
-description: The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
- against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and 
- attempt to crack them offline allowing them to obtain privileged access to the domain. This analytic looks for a specific combination of the Ticket_Options field
- based on common kerberoasting tools. Defenders should be aware that it may be possible for a Kerberoast attack to use different Ticket_Options.
-search: '`wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17
+description: The following analytic leverages Kerberos Event 4769, A Kerberos service
+  ticket was requested, to identify a potential kerberoasting attack against Active
+  Directory networks. Kerberoasting allows an adversary to request kerberos tickets
+  for domain accounts typically used as service accounts and attempt to crack them
+  offline allowing them to obtain privileged access to the domain. This analytic looks
+  for a specific combination of the Ticket_Options field based on common kerberoasting
+  tools. Defenders should be aware that it may be possible for a Kerberoast attack
+  to use different Ticket_Options.
+search: '`wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000
+  OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17
   | stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id,
   Ticket_Encryption_Type, Ticket_Options | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `kerberoasting_spn_request_with_rc4_encryption_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting
   `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
-known_false_positives: Older systems that support kerberos RC4 by default like NetApp may
-  generate false positives. Filter as needed
+known_false_positives: Older systems that support kerberos RC4 by default like NetApp
+  may generate false positives. Filter as needed
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md
 - https://www.trimarcsecurity.com/post/trimarcresearch-detecting-kerberoasting-activity

detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml

@@ -5,34 +5,47 @@ date: '2022-02-22'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
-description: The following analytic leverages Windows Security Event 4738, `A user account was changed`,
-  to identify a change performed on a domain user object that disables Kerberos Pre-Authentication.
-  Disabling the Pre Authentication flag in the UserAccountControl property allows an adversary to easily perform a brute
-  force attack against the user's password offline leveraging the ASP REP Roasting technique.
-  Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor 
-  or a way to escalate privileges.
-search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*"
-| table EventCode, Account_Name, Security_ID, MSADChangedAttributes
-| `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
+description: The following analytic leverages Windows Security Event 4738, `A user
+  account was changed`, to identify a change performed on a domain user object that
+  disables Kerberos Pre-Authentication. Disabling the Pre Authentication flag in the
+  UserAccountControl property allows an adversary to easily perform a brute force
+  attack against the user's password offline leveraging the ASP REP Roasting technique.
+  Red Teams and adversaries alike who have obtained privileges in an Active Directory
+  network may use this technique as a backdoor or a way to escalate privileges.
+search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require
+  Preauth'' - Enabled*" | table EventCode, Account_Name, Security_ID, MSADChangedAttributes
+  | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  Domain Controller events. The Advanced Security Audit policy setting
-  `User Account Management` within `Account Management` needs to be enabled.
+  Domain Controller events. The Advanced Security Audit policy setting `User Account
+  Management` within `Account Management` needs to be enabled.
 known_false_positives: Unknown.
 references:
-- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties 
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
 - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
 - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  - Stage:Persistence
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log
+  impact: 50
   kill_chain_phases:
   - Intrusion
   - Privilege Escalation
+  message: Kerberos Pre Authentication was Disabled for $Account_Name$
   mitre_attack_id:
   - T1558
   - T1558.004
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -43,17 +56,5 @@ tags:
   - Account_Name
   - Security_ID
   - MSADChangedAttributes
-  security_domain: endpoint
-  impact: 50
-  confidence: 90 
   risk_score: 45
-  context:
-  - Source:Endpoint
-  - Stage:PrivilegeEscalation
-  - Stage:Persistence
-  message: Kerberos Pre Authentication was Disabled for $Account_Name$
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml

@@ -6,52 +6,55 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of the `Set-ADAccountControl` commandlet with specific parameters. `Set-ADAccountControl`
-  is part of the Active Directory PowerShell module used to manage Windows Active Directory networks.
-  As the name suggests, `Set-ADAccountControl` is used to modify User Account Control values for an Active Directory domain account.
-  With the appropiate parameters, Set-ADAccountControl allows adversaries to disable Kerberos Pre-Authentication for an account to
-  to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique.
-  Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor 
-  or a way to escalate privileges.
+  to identify the execution of the `Set-ADAccountControl` commandlet with specific
+  parameters. `Set-ADAccountControl` is part of the Active Directory PowerShell module
+  used to manage Windows Active Directory networks. As the name suggests, `Set-ADAccountControl`
+  is used to modify User Account Control values for an Active Directory domain account.
+  With the appropiate parameters, Set-ADAccountControl allows adversaries to disable
+  Kerberos Pre-Authentication for an account to to easily perform a brute force attack
+  against the user's password offline leveraging the ASP REP Roasting technique. Red
+  Teams and adversaries alike who have obtained privileges in an Active Directory
+  network may use this technique as a backdoor or a way to escalate privileges.
 search: ' `powershell` EventCode=4104 (Message = "*Set-ADAccountControl*" AND Message="*DoesNotRequirePreAuth:$true*")
-  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
-  | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`'
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Although unlikely, Administrators may need to set this flag for legitimate purposes.
+known_false_positives: Although unlikely, Administrators may need to set this flag
+  for legitimate purposes.
 references:
-- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties 
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
 - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
 - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  - Stage:Persistence
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log
+  impact: 50
   kill_chain_phases:
   - Intrusion
   - Privilege Escalation
+  message: Kerberos Pre Authentication was Disabled using PowerShell on $dest$
   mitre_attack_id:
   - T1558
   - T1558.004
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - _time
-  security_domain: endpoint
-  impact: 50
-  confidence: 90 
   risk_score: 45
-  context:
-  - Source:Endpoint
-  - Stage:PrivilegeEscalation
-  - Stage:Persistence
-  message: Kerberos Pre Authentication was Disabled using PowerShell on $dest$
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/linux_at_application_execution.yml

@@ -13,10 +13,11 @@ description: The following analytic identifies a suspicious process creation of
   and after this process execution, when it was executed and what schedule task it
   will execute.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
-  where  Processes.process_name IN ("at", "atd") OR Processes.parent_process_name IN ("at", "atd") by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`'
+  where  Processes.process_name IN ("at", "atd") OR Processes.parent_process_name
+  IN ("at", "atd") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from

detections/endpoint/linux_common_process_for_elevation_control.yml

@@ -16,13 +16,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("chmod",
   "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr",
   "lchown", "lremovexattr", "lsetxattr", "removexattr", "setuid", "setgid", "setreuid",
-  "setregid", "chattr") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat
-  *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *",
-  "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid
-  *", "*setregid *", "*setcap *", "*chattr *") by Processes.dest Processes.user Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`'
+  "setregid", "chattr") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod
+  *", "*fchmodat *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *",
+  "*lchown *", "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid
+  *", "*setreuid *", "*setregid *", "*setcap *", "*chattr *") by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from

detections/endpoint/linux_dd_file_overwrite.yml

@@ -6,17 +6,17 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to look for dd command to overwrite file. This technique was abused by adversaries or 
-  threat actor to destroy files or data on specific system or in a large number of host within network to interrupt host avilability,
-  services and many more. This is also used to destroy data where it make the file irrecoverable by forensic techniques through overwriting files,
-  data or local and remote drives.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process_name = "dd" AND Processes.process = "*of=*"
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid 
-  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `linux_dd_file_overwrite_filter`'
+description: This analytic is to look for dd command to overwrite file. This technique
+  was abused by adversaries or threat actor to destroy files or data on specific system
+  or in a large number of host within network to interrupt host avilability, services
+  and many more. This is also used to destroy data where it make the file irrecoverable
+  by forensic techniques through overwriting files, data or local and remote drives.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "dd"
+  AND Processes.process = "*of=*" by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `linux_dd_file_overwrite_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
@@ -29,12 +29,29 @@ references:
 tags:
   analytic_story:
   - Data Destruction
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Impact
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux.log
+  impact: 80
   kill_chain_phases:
   - Exploitation
+  message: A commandline $process$ executed on $dest$
   mitre_attack_id:
   - T1485
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -48,23 +65,5 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 80 
-  # (impact * confidence)/100
   risk_score: 64
-  context:
-  - Source:Endpoint
-  - Stage:Impact
-  message: A commandline $process$ executed on $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  nist:
-  - DE.CM
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
+  security_domain: endpoint

detections/endpoint/linux_system_network_discovery.yml

@@ -6,18 +6,19 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to look for possible enumeration of local network configuration. 
-  This technique is commonly used as part of recon of adversaries or threat actor to know some network information for its next or further
-  attack. This anomaly detections may capture normal event made by administrator during auditing or testing network connection of specific 
-  host or network to network. 
-search: '| tstats `security_content_summariesonly` 
-  count values(Processes.process_name) as process_name_list values(Processes.process) as process_list 
-  values(Processes.process_id) as process_id_list values(Processes.parent_process_id) as parent_process_id_list 
-  values(Processes.process_guid) as process_guid_list dc(Processes.process_name) as process_name_count from datamodel=Endpoint.Processes 
-  where Processes.process_name IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss", "route") 
-  by _time span=30m Processes.dest Processes.user 
-  | where process_name_count >=4
-  | `drop_dm_object_name(Processes)`| `linux_system_network_discovery_filter`'
+description: This analytic is to look for possible enumeration of local network configuration.
+  This technique is commonly used as part of recon of adversaries or threat actor
+  to know some network information for its next or further attack. This anomaly detections
+  may capture normal event made by administrator during auditing or testing network
+  connection of specific host or network to network.
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name_list values(Processes.process) as process_list values(Processes.process_id)
+  as process_id_list values(Processes.parent_process_id) as parent_process_id_list
+  values(Processes.process_guid) as process_guid_list dc(Processes.process_name) as
+  process_name_count from datamodel=Endpoint.Processes where Processes.process_name
+  IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss",
+  "route") by _time span=30m Processes.dest Processes.user | where process_name_count
+  >=4 | `drop_dm_object_name(Processes)`| `linux_system_network_discovery_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
@@ -25,16 +26,33 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
--  https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md
 tags:
   analytic_story:
   - Network Discovery
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Reconaissance
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux.log
+  impact: 30
   kill_chain_phases:
   - Reconnaissance
+  message: A commandline $process$ executed on $dest$
   mitre_attack_id:
   - T1016
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -48,23 +66,5 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 30
-  confidence: 30 
-  # (impact * confidence)/100
   risk_score: 9
-  context:
-  - Source:Endpoint
-  - Stage:Reconaissance
-  message: A commandline $process$ executed on $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  nist:
-  - DE.CM
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
+  security_domain: endpoint

detections/endpoint/log4shell_cve_2021_44228_exploitation.yml

@@ -0,0 +1,80 @@
+name: Log4Shell CVE-2021-44228 Exploitation
+id: 9be30d80-3a39-4df9-9102-64a467b24eac
+version: 1
+date: '2022-01-26'
+author: Jose Hernandez, Splunk
+type: Correlation
+datamodel:
+- Risk
+description: This correlation find exploitation of Log4Shell CVE-2021-44228 against
+  systems using detections from Splunk Security Content Analytic Story. It does this
+  by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections
+  fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume
+  high problability of exploitation. The Analytic story breaks down into 3 major phases
+  of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}`
+  2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral
+  Movement using Powershell or similar T1562.001 Each of these phases fall into different
+  MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking
+  into 2 or more phases showing up in detections triggerd is how this correlation
+  search finds exploitation. If we get a notable from this correlation search the
+  best way to triage it is by investigating the affected systems against Log4Shell
+  exploitation using Splunk SOAR playbooks.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Log4Shell
+  CVE-2021-44228" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic
+  source | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` |
+  `security_content_ctime(lastTime)` | stats values(risk_object) as affected_systems  values(source)
+  as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime)
+  as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic)
+  as distinct_tactics | where distinct_tactics >= 2 | `log4shell_cve_2021_44228_exploitation_filter`'
+how_to_implement: To implement this correlation search a user needs to enable all
+  detections in the Log4Shell Analytic Story and confirm it is generation risk events.
+  A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain
+  events.
+known_false_positives: There are no known false positive for this search, but it could
+  contain false positives as multiple detections can trigger and not have successful
+  exploitation.
+references:
+- https://research.splunk.com/stories/log4shell_cve-2021-44228/
+- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html
+tags:
+  analytic_story:
+  - Log4Shell CVE-2021-44228
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context: null
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/suspicious_behaviour/log4shell_exploitation/log4shell_correlation.txt
+  impact: 90
+  kill_chain_phases:
+  - Reconnaissance
+  - Exploitation
+  - Lateral Movement
+  message: Log4Shell Exploitation detected against $affected_systems$
+  mitre_attack_id:
+  - T1105
+  - T1190
+  - T1059
+  nist:
+  - DE.CM
+  observable:
+  - name: affected_systems
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Risk.analyticstories
+  - All_Risk.risk_object_type
+  - All_Risk.risk_object
+  - All_Risk.annotations.mitre_attack.mitre_tactic
+  - source
+  risk_score: 63
+  security_domain: endpoint

detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml

@@ -6,33 +6,57 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. 
-  Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
-  Defenders should be aware that adversaries may customize the source code of Mimikatz and modify the command line parameters. This would effectively bypass this analytic.
+description: The following analytic looks for the use of Mimikatz command line parameters
+  leveraged to execute pass the ticket attacks. Red teams and adversaries alike may
+  use the pass the ticket technique using stolen Kerberos tickets to move laterally
+  within an environment, bypassing normal system access controls. Defenders should
+  be aware that adversaries may customize the source code of Mimikatz and modify the
+  command line parameters. This would effectively bypass this analytic.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets /export*" 
-  OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`'
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets
+  /export*" OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz.
+known_false_positives: Although highly unlikely, legitimate applications may use the
+  same command line parameters as Mimikatz.
 references:
 - https://github.com/gentilkiwi/mimikatz
-- https://attack.mitre.org/techniques/T1550/003/  
+- https://attack.mitre.org/techniques/T1550/003/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log
+  impact: 60
   kill_chain_phases:
   - Privilege Escalation
+  message: Mimikatz command line parameters for pass the ticket attacks were used
+    on $dest$
   mitre_attack_id:
   - T1550
   - T1550.003
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -47,24 +71,5 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   - Processes.parent_process_name
-  security_domain: endpoint
-  impact: 60
-  confidence: 60 
   risk_score: 36
-  context:
-  - Source:Endpoint
-  - Stage:PrivilegeEscalation
-  message: Mimikatz command line parameters for pass the ticket attacks were used on $dest$ 
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Parent Process
-    role:
-    - Parent Process
+  security_domain: endpoint

detections/endpoint/net_profiler_uac_bypass.yml

@@ -12,14 +12,11 @@ description: This search is to detect modification of registry to bypass UAC win
   the registry key and values in the detection area. It may happened that windows
   update some dll related to mmc.exe and add dll path in this registry. In this case
   filtering is needed.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
-  from datamodel=Endpoint.Registry where 
-  Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_data = "*.dll" 
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `net_profiler_uac_bypass_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH"
+  Registry.registry_value_data = "*.dll" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/powershell_remove_windows_defender_directory.yml

@@ -11,10 +11,9 @@ description: This analytic will identify a suspicious PowerShell command used to
   campaign where it used Nirsofts advancedrun.exe to gain administrative privileges
   to then execute a PowerShell command to delete the Windows Defender folder. This
   is a good indicator the offending process is trying corrupt a Windows Defender installation.
-search: '`powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows Defender*" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
+search: '`powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows
+  Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
+  Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_remove_windows_defender_directory_filter` '
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here

detections/endpoint/process_deleting_its_process_file_path.yml

@@ -11,12 +11,11 @@ description: This detection is to identify a suspicious process that tries to de
   evasion once a certain condition of malware is satisfied or not. Clop ransomware
   use this technique where it will try to delete its process file path using a .bat
   command if the keyboard layout is not the layout it tries to infect.
-search: '`sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image = "*\\cmd.exe" 
-  | eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") 
-  | stats min(_time) as firstTime max(_time) as lastTime count by Computer user ParentImage ParentCommandLine Image CommandLine EventCode ProcessID result 
-  | where result = "Found" 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
+search: '`sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image
+  = "*\\cmd.exe" | eval result = if(like(process,"%".parent_process."%"), "Found",
+  "Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by Computer
+  user ParentImage ParentCommandLine Image CommandLine EventCode ProcessID result
+  | where result = "Found" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `process_deleting_its_process_file_path_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -9,7 +9,8 @@ datamodel:
 description: The search looks for modifications to registry keys that can be used
   to launch an application or service at system startup.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
-  where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls*
+  where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
+  OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls*
   OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify*
   OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet*
   OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices*

detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
   - Remcos
+  - Hermetic Wiper
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/rubeus_command_line_parameters.yml

@@ -6,16 +6,23 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs 
-  MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized in common Kerberos attacks like exporting and importing tickets,
-  forging silver and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory networks.
-  Defenders should be aware that adversaries may customize the source code of Rubeus and modify the command line parameters. This would effectively bypass this analytic.
+description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is
+  heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin
+  project. This analytic looks for the use of Rubeus command line arguments utilized
+  in common Kerberos attacks like exporting and importing tickets, forging silver
+  and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc.
+  Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory
+  networks. Defenders should be aware that adversaries may customize the source code
+  of Rubeus and modify the command line parameters. This would effectively bypass
+  this analytic.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*" 
-  OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR Processes.process ="* asktgs* /service:*" 
-  OR Processes.process ="* golden* /user:*" OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*" 
-  OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*" OR Processes.process = "* brute* /password:*"
-  OR Processes.process = "* brute* /passwords:*" OR Processes.process ="* harvest*") by Processes.dest Processes.user Processes.parent_process
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*"
+  OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR
+  Processes.process ="* asktgs* /service:*" OR Processes.process ="* golden* /user:*"
+  OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*"
+  OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*"
+  OR Processes.process = "* brute* /password:*" OR Processes.process = "* brute* /passwords:*"
+  OR Processes.process ="* harvest*") by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`'
@@ -23,24 +30,44 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed.
+known_false_positives: Although unlikely, legitimate applications may use the same
+  command line parameters as Rubeus. Filter as needed.
 references:
-- https://github.com/GhostPack/Rubeus 
-- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ 
-- https://attack.mitre.org/techniques/T1550/003/ 
+- https://github.com/GhostPack/Rubeus
+- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
+- https://attack.mitre.org/techniques/T1550/003/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+  impact: 60
   kill_chain_phases:
   - Privilege Escalation
+  message: Rubeus command line parameters were used on $dest$
   mitre_attack_id:
   - T1550
   - T1550.003
   - T1558
   - T1558.003
   - T1558.004
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -55,24 +82,5 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   - Processes.parent_process_name
-  security_domain: endpoint
-  impact: 60
-  confidence: 60 
   risk_score: 36
-  context:
-  - Source:Endpoint
-  - Stage:Privilege Escalation
-  message: Rubeus command line parameters were used on $dest$ 
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Parent Process
-    role:
-    - Parent Process
+  security_domain: endpoint

detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml

@@ -5,25 +5,30 @@ date: '2022-02-07'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
-description: The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior
-  when using the Rubeus tool to monitor for and export kerberos tickets from memory. Before being able to export tickets. Rubeus will try to escalate privileges to SYSTEM by
-  obtaining a handle to winlogon.exe before trying to monitor for kerberos tickets. Exporting tickets from memory is typically the first step for pass the ticket attacks.
-  Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
-  Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic.
+description: The following analytic looks for a process accessing the winlogon.exe
+  system process. The Splunk Threat Research team identified this behavior when using
+  the Rubeus tool to monitor for and export kerberos tickets from memory. Before being
+  able to export tickets. Rubeus will try to escalate privileges to SYSTEM by obtaining
+  a handle to winlogon.exe before trying to monitor for kerberos tickets. Exporting
+  tickets from memory is typically the first step for pass the ticket attacks. Red
+  teams and adversaries alike may use the pass the ticket technique using stolen Kerberos
+  tickets to move laterally within an environment, bypassing normal system access
+  controls. Defenders should be aware that adversaries may customize the source code
+  of Rubeus to potentially bypass this analytic.
 search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff)
-  (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND 
-  SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND
-  SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe)
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage,
-  SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename
-  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`'
+  (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe
+  AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe
+  AND SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) | stats count min(_time)
+  as firstTime max(_time) as lastTime by Computer, SourceImage, SourceProcessId, TargetImage,
+  TargetProcessId, EventCode, GrantedAccess | rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`'
 how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
-  includes EventCode 10. This search uses an input macro named `sysmon`.
-  We strongly recommend that you specify your environment-specific configurations
-  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
-  with configurations for your Splunk environment.
-known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
+  includes EventCode 10. This search uses an input macro named `sysmon`. We strongly
+  recommend that you specify your environment-specific configurations (index, source,
+  sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations
+  for your Splunk environment.
+known_false_positives: Legitimate applications may obtain a handle for winlogon.exe.
+  Filter as needed
 references:
 - https://github.com/GhostPack/Rubeus
 - http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
@@ -31,14 +36,29 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+  impact: 60
   kill_chain_phases:
   - Privilege Escalation
   - Lateral Movement
+  message: Winlogon.exe was accessed by $SourceImage$ on $dest$
   mitre_attack_id:
   - T1550
   - T1550.003
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: TargetImage
+    type: Process
+    role:
+    - Target
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -52,20 +72,5 @@ tags:
   - TargetProcessId
   - SourceImage
   - SourceProcessId
-  security_domain: endpoint
-  impact: 60
-  confidence: 60
   risk_score: 36
-  context:
-  - Source:Endpoint
-  - Stage:Privilege Escalation
-  message: Winlogon.exe was accessed by $SourceImage$ on $dest$
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: TargetImage
-    type: Process
-    role:
-    - Target
+  security_domain: endpoint

detections/endpoint/rundll32_dnsquery.yml

@@ -11,11 +11,9 @@ description: This search is to detect a suspicious rundll32.exe process having a
   malware where the rundll32 that execute its payload will contact amazon.com to check
   internet connect and to communicate to its C&C server to download config and other
   file component.
-search: '`sysmon` EventCode=22 process_name="rundll32.exe" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId  Computer 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `rundll32_dnsquery_filter`'
+search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time)
+  as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId  Computer
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name and eventcode = 22 dnsquery executions from your endpoints.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -6,19 +6,25 @@ author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the creation or deletion of a scheduled task using schtasks.exe with flags - create or delete being passed on the command-line. This has been associated with
-  the Dragonfly threat actor, and the SUNBURST attack against Solarwinds.
-  This analytic replaces "Scheduled Task used in BadRabbit Ransomware".
+description: The following analytic identifies the creation or deletion of a scheduled
+  task using schtasks.exe with flags - create or delete being passed on the command-line.
+  This has been associated with the Dragonfly threat actor, and the SUNBURST attack
+  against Solarwinds. This analytic replaces "Scheduled Task used in BadRabbit Ransomware".
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
   (Processes.process=*delete* OR Processes.process=*create*) by Processes.user Processes.process_name
   Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_deleted_or_created_via_cmd_filter` '
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: It is possible scripts or administrators may trigger this analytic. Filter as needed based on parent process, application.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: It is possible scripts or administrators may trigger this analytic.
+  Filter as needed based on parent process, application.
 references:
-  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
+- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
 tags:
   analytic_story:
   - DHS Report TA18-074A

detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

@@ -8,14 +8,12 @@ datamodel:
 - Endpoint
 description: Monitor for changes of the ExecutionPolicy in the registry to the values
   "unrestricted" or "bypass," which allows the execution of malicious scripts.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from 
-  datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* 
-  Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted OR Registry.registry_value_data=Bypass) 
-  by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell*
+  Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted
+  OR Registry.registry_value_data=Bypass) by Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Registry node. You must also be
   ingesting logs with the fields registry_path, registry_key_name, and registry_value_name

detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml

@@ -1,7 +1,7 @@
 name: Detect Prohibited Applications Spawning cmd exe
 id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
-version: 2
-date: '2020-11-10'
+version: 3
+date: '2022-03-01'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
 datamodel:
@@ -12,22 +12,28 @@ description: The following analytic identifies parent processes, browsers, Windo
   need to be tuned to further enhance the risk.
 search: '| from read_ssa_enriched_events()
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
-  | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
-  parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
-  null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event,
-  "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
-  "string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null)
-  | where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
+  | eval process_name = ucast(map_get(input_event, "process_name"), "string", null),
+    parent_process_name = lower(ucast(input_event.parent_process_name, "string", null)),
+    cmd_line = lower(ucast(map_get(input_event, "process"),"string", null)),
+    dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
+    dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+    event_id=ucast(map_get(input_event,"event_id"), "string", null)
+  | where process_name="cmd.exe"
+  | rex field=parent_process_name "(?<ParentBaseFileName>[^\\\\]+)$"
   | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe"
-  OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
-  OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
-  OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
-  AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)patch1-Hotfix1a/)=false)))
-  OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
-  IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
-  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
-  dest_user_id), body=create_map(["event_id", event_id,  "process_name", process_name,
-  "parent_process_name", parent_process, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+    OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
+    OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
+    OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe"
+    OR (ParentBaseFileName="java.exe"
+      AND (parent_process_name IS NOT NULL AND match_regex(parent_process_name, /(?i)patch1-Hotfix1a/)=false))
+    OR ParentBaseFileName="powershell.exe"
+    OR (ParentBaseFileName="chrome.exe"
+      AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)chrome-extension/)=false)))
+  | eval start_time=timestamp, end_time=timestamp,
+    entities=mvappend(dest_device_id, dest_user_id),
+    body=create_map(["event_id", event_id,  "process_name", process_name, "parent_process_name",
+      parent_process_name, "cmd_line", cmd_line, "ParentBaseFileName", ParentBaseFileName])
+  | into write_ssa_detected_events()'
 how_to_implement: In order to successfully implement this analytic, you will need
   endpoint process data from a EDR product or Sysmon. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.

detections/endpoint/ssa___windows_bits_job_persistence.yml

@@ -0,0 +1,91 @@
+name: Windows Bits Job Persistence
+id: 1e25e97a-8ea4-11ec-9767-acde48001122
+version: 1
+date: '2022-02-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
+  The query identifies the parameters used to create, resume or add a file to a BITS
+  job. Typically seen combined in a oneliner or ran in sequence. If identified, review
+  the BITS job created and capture any files written to disk. It is possible for BITS
+  to be used to upload files and this may require further network data analysis to
+  identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line,
+  "%setnotifyflags%") OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line,
+  "%setminretrydelay%") OR like (cmd_line, "%setcustomheaders%") OR like (cmd_line,
+  "%resume%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives will be present. Typically, applications
+  will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
+  (legitimate applications) or parent process.
+references:
+- https://attack.mitre.org/techniques/T1197/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
+- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
+tags:
+  analytic_story:
+  - BITS Jobs
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
+  mitre_attack_id:
+  - T1197
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 56
+  security_domain: endpoint

detections/endpoint/ssa___windows_bitsadmin_download_file.yml

@@ -0,0 +1,95 @@
+name: Windows Bitsadmin Download File
+id: d76e8188-8f5a-11ec-ace4-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
+  object. In addition, look for `download` or `upload` on the command-line, the switches
+  are not required to perform a transfer. Capture any files downloaded. Review the
+  reputation of the IP or domain used. Typically once executed, a follow on command
+  will be used to execute the dropped file. Note that the network connection or file
+  modification events related will not spawn or create from `bitsadmin.exe`, but the
+  artifacts will appear in a parallel process of `svchost.exe` with a command-line
+  similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel
+  and child processes to capture any behaviors and artifacts. In some suspicious and
+  malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
+  to list out the jobs during investigation.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
+  "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives, however it may be required to filter
+  based on parent process name or network connection.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
+- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
+- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
+- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - BITS Jobs
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/ssa___windows_certutil_decode_file.yml

@@ -0,0 +1,90 @@
+name: Windows CertUtil Decode File
+id: b06983f4-8f72-11ec-ab50-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
+  and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
+  and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
+  file that was downloaded. Once decoded, it will be loaded by a parallel process.
+  Note that there are two additional command switches that may be used - `encodehex`
+  and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
+  further execution. During triage, identify the source of the file being decoded.
+  Review its contents or execution behavior for further analysis.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%decode%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
+  "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Typically seen used to `encode` files, but it is possible to
+  see legitimate use of `decode`. Filter based on parent-child relationship, file
+  paths, endpoint or user.
+references:
+- https://attack.mitre.org/techniques/T1140/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
+- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
+tags:
+  analytic_story:
+  - Deobfuscate-Decode Files or Information
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/ master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file
+    on disk.
+  mitre_attack_id:
+  - T1140
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 40
+  security_domain: endpoint

detections/endpoint/ssa___windows_certutil_urlcache_download.yml

@@ -0,0 +1,86 @@
+name: Windows CertUtil URLCache Download
+id: 8cb1ad38-8f6d-11ec-87a3-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: Certutil.exe may download a file from a remote destination using `-urlcache`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
+  During triage, capture any files on disk and review. Review the reputation of the
+  remote IP or domain in question.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
+  "%urlcache%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/ssa___windows_certutil_verifyctl_download.yml

@@ -0,0 +1,87 @@
+name: Windows CertUtil VerifyCtl Download
+id: 9ac29c40-8f6b-11ec-b19a-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  \ During triage, capture any files on disk and review. Review the reputation of
+  the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
+  written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
+  "%verifyctl%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml

@@ -6,40 +6,52 @@ author: Lou Stella, Splunk
 type: Anomaly
 datamodel:
 - Endpoint_Processes
-description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a scripting mode intended for complex scripted backup operations. This feature also allows for execution of arbitrary unsigned code. This analytic looks for the usage of the scripting mode flags in executions of DiskShadow. During triage, compare to known backup behavior in your environment and then review the scripts called by diskshadow. 
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="diskshadow.exe" AND (like (cmd_line, "%-s%") OR like (cmd_line, "%/s%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();'
-how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel.
-known_false_positives: Administrators using the DiskShadow tool in their infrastructure as a main backup tool with scripts will cause false positives
+description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server.
+  It has a scripting mode intended for complex scripted backup operations. This feature
+  also allows for execution of arbitrary unsigned code. This analytic looks for the
+  usage of the scripting mode flags in executions of DiskShadow. During triage, compare
+  to known backup behavior in your environment and then review the scripts called
+  by diskshadow.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event,
+  "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="diskshadow.exe"
+  AND (like (cmd_line, "%-s%") OR like (cmd_line, "%/s%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on processes that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Administrators using the DiskShadow tool in their infrastructure
+  as a main backup tool with scripts will cause false positives
 references:
--  https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
+- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
 tags:
   analytic_story:
   - Living Off The Land
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1218
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - cmd_line
-  security_domain: endpoint
-  impact: 70
-  confidence: 70 
-  risk_score: 49
+  cis20:
+  - CIS 8
+  confidence: 70
   context:
   - Source:Endpoint
   - Stage:Execution
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
+  mitre_attack_id:
+  - T1218
+  nist:
+  - DE.CM
   observable:
   - name: dest_device_id
     type: Hostname
@@ -57,7 +69,16 @@ tags:
     type: Process
     role:
     - Child Process
-  nist:
-  - DE.CM
-  cis20:
-  - CIS 8
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml

@@ -0,0 +1,85 @@
+name: Windows Eventvwr UAC Bypass
+id: 66adff66-90d9-11ec-aba7-acde48001122
+version: 1
+date: '2022-02-18'
+author: Lou Stella, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Registry
+description: The following search identifies Eventvwr bypass by identifying the registry
+  modification into a specific path that eventvwr.msc looks to (but is not valid)
+  upon execution. A successful attack will include a suspicious command to be executed
+  upon eventvwr.msc loading. Upon triage, review the parallel processes that have
+  executed. Identify any additional registry modifications on the endpoint that may
+  look suspicious. Remediate as necessary.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)),
+  registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)),
+  registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string",
+  null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"),
+  "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"),
+  "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"),
+  "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"),
+  "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive",
+  registry_hive, "registry_value_name", registry_value_name, "registry_key_name",
+  registry_key_name, "registry_value_type", registry_value_type, "registry_value_data",
+  registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Registry` datamodel.
+known_false_positives: None known at this time.
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://attack.mitre.org/techniques/T1548/002
+- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - IcedID
+  - Living Off The Land
+  cis20:
+  - CIS 14
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+  impact: 80
+  kill_chain_phases:
+  - Privilege Escalation
+  message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  nist:
+  - DE.AE
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - event_id
+  - registry_path
+  - registry_hive
+  - registry_value_name
+  - registry_key_name
+  - registry_value_type
+  - registry_value_data
+  - process_guid
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint

detections/endpoint/ssa___windows_mshta_child_process.yml

@@ -0,0 +1,91 @@
+name: Windows MSHTA Child Process
+id: f63f7e9c-9526-11ec-9fc7-acde48001122
+version: 1
+date: '2022-02-23'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies child processes spawning from  "mshta.exe".
+  The search will return the first time and last time these command-line arguments
+  were used for these executions, as well as the target system, the user, parent process
+  "mshta.exe" and its child process.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT
+  NULL | where parent_process_name="mshta.exe" AND process_name="powershell.exe" OR
+  process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe"
+  OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe"
+  OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe"  OR process_name="wscript.exe"
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+tags:
+  analytic_story:
+  - Suspicious MSHTA Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
+    destination to download an additional payload.
+  mitre_attack_id:
+  - T1218.005
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/ssa___windows_mshta_command_line_url.yml

@@ -0,0 +1,93 @@
+name: Windows MSHTA Command-Line URL
+id: 9b35c538-94ef-11ec-9439-acde48001122
+version: 1
+date: '2022-02-23'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
+  utility is used to make remote http connections. Adversaries may use mshta.exe to
+  proxy the download and execution of remote .hta files. The analytic identifies command
+  line arguments of http and https being used. This technique is commonly used by
+  malicious software to bypass preventative controls. The search will return the first
+  time and last time these command-line arguments were used for these executions,
+  as well as the target system, the user, process "rundll32.exe" and its parent process.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: It is possible legitimate applications may perform this behavior
+  and will need to be filtered.
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+tags:
+  analytic_story:
+  - Suspicious MSHTA Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
+    destination to download an additional payload.
+  mitre_attack_id:
+  - T1218.005
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml

@@ -0,0 +1,91 @@
+name: Windows MSHTA Inline HTA Execution
+id: 24962154-9524-11ec-9333-acde48001122
+version: 1
+date: '2022-02-23'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies "mshta.exe" execution with inline protocol
+  handlers. "JavaScript", "VBScript", and "About" are the only supported options when
+  invoking HTA content directly on the command-line. The search will return the first
+  time and last time these command-line arguments were used for these executions,
+  as well as the target system, the user, process "mshta.exe" and its parent process.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe"
+  AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line,
+  "%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+tags:
+  analytic_story:
+  - Suspicious MSHTA Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA,
+    indicative of defense evasion.
+  mitre_attack_id:
+  - T1218.005
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml

@@ -0,0 +1,88 @@
+name: Windows PowerShell Start-BitsTransfer
+id: 0bafd086-8f61-11ec-996e-acde48001122
+version: 1
+date: '2022-02-16'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar
+  functionality is present. This technique variation is not as commonly used by adversaries,
+  but has been abused in the past. Lesser known uses include the ability to set the
+  `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload`
+  is used, it is highly possible files will be archived. During triage, review parallel
+  processes and process lineage. Capture any files on disk and review. For the remote
+  domain or IP, what is the reputation?
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
+  (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Limited false positives. It is possible administrators will
+  utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
+  process or command-line arguments.
+references:
+- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
+- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
+tags:
+  analytic_story:
+  - BITS Jobs
+  - Living Off The Land
+  automated_detection_testing: passed
+  cis20: []
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/ssa___windows_rasautou_dll_execution.yml

@@ -0,0 +1,86 @@
+name: Windows Rasautou DLL Execution
+id: 6f42b8ce-1e15-11ec-ad5a-acde48001122
+version: 1
+date: '2022-02-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the Windows Windows Remote Auto Dialer,
+  rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary
+  shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review
+  parent and child process behavior including file and image loads.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe"
+  AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives will be limited to applications that require
+  Rasautou.exe to load a DLL from disk. Filter as needed.
+references:
+- https://github.com/mandiant/DueDLLigence
+- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
+- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513
+- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Living Off The Land
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+  mitre_attack_id:
+  - T1055.001
+  - T1218
+  - T1055
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml

@@ -0,0 +1,98 @@
+name: Windows Rundll32 Inline HTA Execution
+id: 0caa1dd6-94f5-11ec-9786-acde48001122
+version: 1
+date: '2022-02-23'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies "rundll32.exe" execution with inline
+  protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
+  options when invoking HTA content directly on the command-line. This type of behavior
+  is commonly observed with fileless malware or application whitelisting bypass techniques.
+  The search will return the first time and last time these command-line arguments
+  were used for these executions, as well as the target system, the user, process
+  "rundll32.exe" and its parent process.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="rundll32.exe"
+  AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line,
+  "%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+tags:
+  analytic_story:
+  - Suspicious MSHTA Activity
+  - NOBELIUM Group
+  - Living Off The Land
+  asset_type: Endpoint
+  automated_detection_testing: passed
+  cis20:
+  - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Execution
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Suspicious $process_name$ inline HTA execution on $dest_device_id$.
+  mitre_attack_id:
+  - T1218
+  - T1218.005
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 56
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/suspicious_linux_discovery_commands.yml

@@ -6,16 +6,24 @@ author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search, detects execution of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of possible paths of privilege execution, password files, vulnerable directories, executables and file permissions on a Linux host.\
-  
-  The search logic specifically looks for high number of distinct commands run in a short period of time. 
-search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as distinct_commands dc(Processes.process_name) as distinct_process_names min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where [|inputlookup linux_tool_discovery_process.csv | rename process as Processes.process |table Processes.process] by _time span=5m Processes.user Processes.dest
-| `drop_dm_object_name(Processes)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)`| where distinct_commands > 40 AND distinct_process_names > 3| `suspicious_linux_discovery_commands_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). 
-  Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment.
+description: 'This search, detects execution of suspicious bash commands from various
+  commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery
+  of possible paths of privilege execution, password files, vulnerable directories,
+  executables and file permissions on a Linux host.\
+
+  The search logic specifically looks for high number of distinct commands run in
+  a short period of time.'
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process)
+  as distinct_commands dc(Processes.process_name) as distinct_process_names min(_time)
+  as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where [|inputlookup
+  linux_tool_discovery_process.csv | rename process as Processes.process |table Processes.process]
+  by _time span=5m Processes.user Processes.dest | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| where
+  distinct_commands > 40 AND distinct_process_names > 3| `suspicious_linux_discovery_commands_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/).
+  Please install this add-on to parse fields correctly and execute detection search.
+  Consider customizing the time window and threshold values according to your environment.
 known_false_positives: Unless an administrator is using these commands to troubleshoot
   or audit a system, the execution of these commands should be monitored.
 references:
@@ -53,7 +61,7 @@ tags:
   - _time
   - Processes.process
   - Processes.parent_process_name
-  - Processes.user 
+  - Processes.user
   - Processes.process_name
   risk_score: 81
   security_domain: endpoint

detections/endpoint/suspicious_process_file_path.yml

@@ -35,6 +35,7 @@ tags:
   - XMRig
   - Remcos
   - WhisperGate
+  - Hermetic Wiper
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml

@@ -5,21 +5,22 @@ date: '2022-02-08'
 author: Mauricio Velazco, Splunk
 type: Anomaly
 datamodel: []
-description: The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
- against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and 
- attempt to crack them offline allowing them to obtain privileged access to the domain.\
- 
- The detection calculates the standard deviation for each host and leverages the
- 3-sigma statistical rule to identify an unusual number service ticket requests. To customize this
- analytic, users can try different combinations of the `bucket` span time and the
- calculation of the `upperBound` field. 
+description: 'The following hunting analytic leverages Kerberos Event 4769, A Kerberos
+  service ticket was requested, to identify a potential kerberoasting attack against
+  Active Directory networks. Kerberoasting allows an adversary to request kerberos
+  tickets for domain accounts typically used as service accounts and attempt to crack
+  them offline allowing them to obtain privileged access to the domain.\
+
+  The detection calculates the standard deviation for each host and leverages the
+  3-sigma statistical rule to identify an unusual number service ticket requests.
+  To customize this analytic, users can try different combinations of the `bucket`
+  span time and the calculation of the `upperBound` field.'
 search: ' `wineventlog_security` EventCode=4769 Service_Name!="*$" Ticket_Encryption_Type=0x17
-| bucket span=2m _time
-| stats dc(Service_Name) AS unique_services values(Service_Name) as requested_services by _time, Client_Address
-| eventstats avg(unique_services) as comp_avg , stdev(unique_services) as comp_std by Client_Address
-| eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_services > 2 and unique_services >= upperBound, 1, 0)
-| search isOutlier=1
-| `unusual_number_of_kerberos_service_tickets_requested_filter`'
+  | bucket span=2m _time | stats dc(Service_Name) AS unique_services values(Service_Name)
+  as requested_services by _time, Client_Address | eventstats avg(unique_services)
+  as comp_avg , stdev(unique_services) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
+  | eval isOutlier=if(unique_services > 2 and unique_services >= upperBound, 1, 0)
+  | search isOutlier=1 | `unusual_number_of_kerberos_service_tickets_requested_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting
   `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
@@ -29,17 +30,28 @@ known_false_positives: An single endpoint requesting a large number of kerberos
   systems.
 references:
 - https://attack.mitre.org/techniques/T1558/003/
-- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting 
+- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
+  impact: 60
   kill_chain_phases:
   - Privilege Escalation
+  message: null
   mitre_attack_id:
   - T1558
   - T1558.003
+  observable:
+  - name: Client_Address
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -53,16 +65,5 @@ tags:
   - Service_Name
   - service_id
   - Client_Address
-  security_domain: endpoint
-  impact: 60
-  confidence: 60 
   risk_score: 36
-  context:
-  - Source:Endpoint
-  - Stage:Privilege Escalation
-  message: 
-  observable:
-  - name: Client_Address
-    type: Endpoint
-    role:
-    - Victim
+  security_domain: endpoint

detections/endpoint/windows_disable_memory_crash_dump.yml

@@ -0,0 +1,98 @@
+name: Windows Disable Memory Crash Dump
+id: 59e54602-9680-11ec-a8a6-acde48001122
+version: 1
+date: '2022-02-25'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a process that is attempting to disable
+  the ability on Windows to generate a memory crash dump. This was recently identified
+  being utilized by HermeticWiper. To disable crash dumps, the value must be set to
+  0. This feature is typically modified to perform a memory crash dump when a computer
+  stops unexpectedly because of a Stop error (also known as a blue screen, system
+  crash, or bug check).
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
+  where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled")
+  AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid Registry.registry_key_name  | `drop_dm_object_name(Registry)`
+  |join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)`  | fields _time dest user parent_process_name parent_process
+  process_name process_path process process_guid registry_path registry_value_name
+  registry_value_data registry_key_name] | table _time dest user parent_process_name
+  parent_process process_name process_path process process_guid registry_path registry_value_name
+  registry_value_data registry_key_name | `windows_disable_memory_crash_dump_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry`
+  node.
+known_false_positives: unknown
+references:
+- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options
+tags:
+  analytic_story:
+  - Data Destruction
+  - Ransomware
+  - Hermetic Wiper
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: A process $process_name$ was identified attempting to disable memory crash
+    dumps on $dest$.
+  mitre_attack_id:
+  - T1485
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
+  - Filesystem.dest
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_guid
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/windows_diskshadow_proxy_execution.yml

@@ -6,21 +6,52 @@ author: Lou Stella, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a scripting mode intended for complex scripted backup operations. This feature also allows for execution of arbitrary unsigned code. This analytic looks for the usage of the scripting mode flags in executions of DiskShadow. During triage, compare to known backup behavior in your environment and then review the scripts called by diskshadow. 
-search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_diskshadow` (Processes.process=*-s* OR Processes.process=*/s*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_diskshadow_proxy_execution_filter`"
-how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: Administrators using the DiskShadow tool in their infrastructure as a main backup tool with scripts will cause false positives that can be filtered with `windows_diskshadow_proxy_execution_filter`
+description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server.
+  It has a scripting mode intended for complex scripted backup operations. This feature
+  also allows for execution of arbitrary unsigned code. This analytic looks for the
+  usage of the scripting mode flags in executions of DiskShadow. During triage, compare
+  to known backup behavior in your environment and then review the scripts called
+  by diskshadow.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_diskshadow` (Processes.process=*-s*
+  OR Processes.process=*/s*) by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_diskshadow_proxy_execution_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on processes that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,confirm
+  the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint
+  product.
+known_false_positives: Administrators using the DiskShadow tool in their infrastructure
+  as a main backup tool with scripts will cause false positives that can be filtered
+  with `windows_diskshadow_proxy_execution_filter`
 references:
--  https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
+- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
 tags:
   analytic_story:
   - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Exploitation
+  message: Possible Signed Binary Proxy Execution on $dest$
   mitre_attack_id:
   - T1218
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -35,20 +66,5 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   - Processes.original_file_name
-  security_domain: endpoint
-  impact: 70
-  confidence: 70
   risk_score: 49
-  context: 
-  - Source:Endpoint
-  - Stage:Execution
-  message: Possible Signed Binary Proxy Execution on $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  nist:
-  - DE.CM
-  cis20:
-  - CIS 8
+  security_domain: endpoint

detections/endpoint/windows_event_for_service_disabled.yml

@@ -0,0 +1,63 @@
+name: Windows Event For Service Disabled
+id: 9c2620a8-94a1-11ec-b40c-acde48001122
+version: 1
+date: '2022-02-23'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic will identify suspicious system event of services that
+  was modified from start to disabled. This technique is seen where the adversary
+  attempts to disable security app services, other malware services to evade the defense
+  systems on the compromised host
+search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from
+  demand start to disabled." | stats count min(_time) as firstTime max(_time) as lastTime
+  by ComputerName EventCode Message User Sid | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_event_for_service_disabled_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints.
+known_false_positives: Windows service update may cause this event. In that scenario,
+  filtering is needed.
+references:
+- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Service was disabled on $Computer$
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  nist:
+  - DE.CM
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ComputerName
+  - EventCode
+  - Message
+  - User
+  - Sid
+  risk_score: 36
+  security_domain: endpoint

detections/endpoint/windows_excessive_disabled_services_event.yml

@@ -0,0 +1,66 @@
+name: Windows Excessive Disabled Services Event
+id: c3f85976-94a5-11ec-9a58-acde48001122
+version: 1
+date: '2022-02-23'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic will identify suspicious excessive number of system events
+  of services that was modified from start to disabled. This technique is seen where
+  the adversary attempts to disable security app services, other malware services
+  oer serve as an destructive impact to complete the objective on the compromised
+  system. One good example for this scenario is Olympic destroyer where it disable
+  all active services in the compromised host as part of its destructive impact and
+  defense evasion.
+search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from
+  demand start to disabled." | stats count values(Message) as MessageList dc(Message)
+  as MessageCount min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode  User
+  Sid | where MessageCount >=10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_excessive_disabled_services_event_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints.
+known_false_positives: Unknown
+references:
+- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: Service was disabled in $Computer$
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  nist:
+  - DE.CM
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ComputerName
+  - EventCode
+  - Message
+  - User
+  - Sid
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/windows_file_without_extension_in_critical_folder.yml

@@ -0,0 +1,77 @@
+name: Windows File Without Extension In Critical Folder
+id: 0dbcac64-963c-11ec-bf04-acde48001122
+version: 1
+date: '2022-02-25'
+author: Teoderick Contreras, Bhavin Patel, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious file creation in the critical
+  folder like "System32\Drivers" folder without file extension. This artifacts was
+  seen in latest hermeticwiper where it drops its driver component in Driver Directory
+  both the compressed(without file extension) and the actual driver component (with
+  .sys file extension). This TTP is really a good indication that a host might be
+  compromised by this destructive malware that wipes the boot sector of the system.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
+  where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*")
+  by _time span=5m Filesystem.dest Filesystem.user Filesystem.file_name Filesystem.file_path
+  Filesystem.process_guid Filesystem.file_create_time | `drop_dm_object_name(Filesystem)`
+  | rex field="file_name" "\.(?<extension>[^\.]*$)" | where isnull(extension) | join
+  process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=5m Processes.process_name Processes.dest Processes.process_guid Processes.user
+  | `drop_dm_object_name(Processes)`] | stats count min(_time) as firstTime max(_time)
+  as lastTime by dest process_name process_guid file_name file_path file_create_time
+  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_file_without_extension_in_critical_folder_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: Unknown at this point
+references:
+- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+tags:
+  analytic_story:
+  - Data Destruction
+  - Hermetic Wiper
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: Driver file with out file extension drop in $file_path$ in $dest$
+  mitre_attack_id:
+  - T1485
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
+  - Filesystem.dest
+  - Processes.process_name
+  - Processes.dest
+  - Processes.process_guid
+  - Processes.user
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/windows_high_file_deletion_frequency.yml

@@ -1,4 +1,4 @@
-name: High File Deletion Frequency
+name: Windows High File Deletion Frequency
 id: 45b125c4-866f-11eb-a95a-acde48001122
 version: 1
 date: '2021-03-16'
@@ -10,12 +10,13 @@ description: This search looks for high frequency of file deletion relative to p
   name and process id. These events usually happen when the ransomware tries to encrypt
   the files with the ransomware file extensions and sysmon treat the original files
   to be deleted as soon it was replace as encrypted data.
-search: '`sysmon` EventCode=23 TargetFilename IN ("*\.cmd", "*\.ini","*\.gif", "*\.jpg",
-  "*\.jpeg", "*\.db", "*\.ps1", "*\.doc*", "*\.xls*", "*\.ppt*", "*\.bmp","*\.zip",
-  "*\.rar", "*\.7z", "*\.chm", "*\.png", "*\.log", "*\.vbs", "*\.js") | stats values(TargetFilename)
-  as deleted_files min(_time) as firstTime max(_time) as lastTime count by Computer
-  user EventCode Image ProcessID |where count >=100 | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `high_file_deletion_frequency_filter`'
+search: '`sysmon` EventCode=23 TargetFilename IN ("*.cmd", "*.ini","*.gif", "*.jpg",
+  "*.jpeg", "*.db", "*.ps1", "*.doc*", "*.xls*", "*.ppt*", "*.bmp","*.zip", "*.rar",
+  "*.7z", "*.chm", "*.png", "*.log", "*.vbs", "*.js", "*.vhd", "*.bak", "*.wbcat",
+  "*.bkf" , "*.backup*", "*.dsk", , "*.win") | stats values(TargetFilename) as deleted_files
+  min(_time) as firstTime max(_time) as lastTime count by Computer user EventCode
+  Image ProcessID |where count >=100 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_high_file_deletion_frequency_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the deleted target file name, process name and process id  from your endpoints.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml

@@ -0,0 +1,73 @@
+name: Windows Modify Show Compress Color And Info Tip Registry
+id: b7548c2e-9a10-11ec-99e3-acde48001122
+version: 1
+date: '2022-03-02'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious registry modification related
+  to file compression color and information tips. This IOC was seen in hermetic wiper
+  where it has a thread that will create this registry entry to change the color of
+  compressed or encrypted files in NTFS file system as well as the pop up information
+  tips. This is a good indicator that a process tries to modified one of the registry
+  GlobalFolderOptions related to file compression attribution in terms of color in
+  NTFS file system.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*"
+  AND Registry.registry_value_name  IN("ShowCompColor", "ShowInfoTip") by _time span=1h
+  Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_modify_show_compress_color_and_info_tip_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+known_false_positives: unknown
+references:
+- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Hermetic Wiper
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$
+  mitre_attack_id:
+  - T1112
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
+  risk_score: 25
+  security_domain: endpoint

detections/endpoint/windows_process_with_namedpipe_commandline.yml

@@ -0,0 +1,77 @@
+name: Windows Process With NamedPipe CommandLine
+id: e64399d4-94a8-11ec-a9da-acde48001122
+version: 1
+date: '2022-02-23'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to look for process commandline that contains named
+  pipe. This technique was seen in some adversaries, threat actor and malware like
+  olympic destroyer to communicate to its other child processes after process injection
+  that serve as defense evasion and privilege escalation. On the other hand this analytic
+  may catch some normal process that using this technique for example browser application.
+  In that scenario we include common process path we've seen during testing that cause
+  false positive which is the program files. False positive may still be arise if
+  the normal application is in other folder path.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\\\.\\pipe\\*"
+  NOT (Processes.process_path IN ("*\\program files*")) by Processes.parent_process_name
+  Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
+  Processes.process_id Processes.parent_process_path Processes.process_guid Processes.parent_process_id
+  Processes.dest Processes.user Processes.process_path | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_namedpipe_commandline_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Normal browser application may use this technique. Please update
+  the filter macros to remove false positives.
+references:
+- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Process with named pipe in $process$ on $dest$
+  mitre_attack_id:
+  - T1055
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.process_guid
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_raw_access_to_disk_volume_partition.yml

@@ -0,0 +1,69 @@
+name: Windows Raw Access To Disk Volume Partition
+id: a85aa37e-9647-11ec-90c5-acde48001122
+version: 1
+date: '2022-02-25'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious raw access read to device disk
+  partition of the host machine. This technique was seen in several attacks by adversaries
+  or threat actor to wipe, encrypt or overwrite the boot sector of each partition
+  as part of their impact payload for example the "hermeticwiper" malware. This detection
+  is a good indicator that there is a process try to read or write on boot sector.
+search: '`sysmon` EventCode=9 Device = \\Device\\HarddiskVolume* NOT (Image IN("*\\Windows\\System32\\*",
+  "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as
+  lastTime by Image Device ProcessGuid ProcessId EventDescription EventCode Computer
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_disk_volume_partition_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the raw access read event (like sysmon eventcode 9), process name and
+  process guid from your endpoints. If you are using Sysmon, you must have at least
+  version 6.0.4 of the Sysmon TA.
+known_false_positives: This event is really notable but we found minimal number of
+  normal application from system32 folder like svchost.exe accessing it too. In this
+  case we used 'system32' and 'syswow64' path as a filter for this detection.
+references:
+- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+tags:
+  analytic_story:
+  - Data Destruction
+  - Hermetic Wiper
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: Process accessing disk partition $device$ in $dest$
+  mitre_attack_id:
+  - T1561.002
+  - T1561
+  nist:
+  - DE.CM
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - Image
+  - Device
+  - ProcessGuid
+  - ProcessId
+  - EventDescription
+  - EventCode
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml

@@ -0,0 +1,71 @@
+name: Windows Raw Access To Master Boot Record Drive
+id: 7b83f666-900c-11ec-a2d9-acde48001122
+version: 1
+date: '2022-02-17'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious raw access read to drive where
+  the master boot record is placed. This technique was seen in several attacks by
+  adversaries or threat actor to wipe, encrypt or overwrite the master boot record
+  code as part of their impact payload. This detection is a good indicator that there
+  is a process try to read or write on MBR sector.
+search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*",
+  "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as
+  lastTime by Computer Image Device ProcessGuid ProcessId EventDescription EventCode
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_master_boot_record_drive_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the raw access read event (like sysmon eventcode 9), process name and
+  process guid from your endpoints. If you are using Sysmon, you must have at least
+  version 6.0.4 of the Sysmon TA.
+known_false_positives: This event is really notable but we found minimal number of
+  normal application from system32 folder like svchost.exe accessing it too. In this
+  case we used 'system32' and 'syswow64' path as a filter for this detection.
+references:
+- https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html
+- https://www.crowdstrike.com/blog/technical-analysis-of-whispergate-malware/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+tags:
+  analytic_story:
+  - WhisperGate
+  - Hermetic Wiper
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: process accessing MBR $device$ in $dest$
+  mitre_attack_id:
+  - T1561.002
+  - T1561
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - Image
+  - Device
+  - ProcessGuid
+  - ProcessId
+  - EventDescription
+  - EventCode
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/windows_service_creation_using_registry_entry.yml

@@ -0,0 +1,85 @@
+name: Windows Service Creation Using Registry Entry
+id: 25212358-948e-11ec-ad47-acde48001122
+version: 1
+date: '2022-02-23'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious modification or creation of registry
+  to have service entry. This technique is abused by adversaries or threat actor to
+  persist, gain privileges in the machine or even lateral movement. This technique
+  can be executed using reg.exe application or using windows API like for example
+  the CrashOveride malware. This detection is a good indicator that a process is trying
+  to create a service entry using registry ImagePath.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*"
+  Registry.registry_value_name = ImagePath by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
+  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_service_creation_using_registry_entry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: Third party tools may used this technique to create services
+  but not so common.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  - Suspicious Windows Registry Activities
+  - Windows Persistence Techniques
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: A Windows Service was created on a endpoint from $dest$
+  mitre_attack_id:
+  - T1574.011
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_guid
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_wmi_process_call_create.yml

@@ -0,0 +1,79 @@
+name: Windows WMI Process Call Create
+id: 0661c2de-93de-11ec-9833-acde48001122
+version: 1
+date: '2022-02-22'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic is to look for wmi commandlines to execute or create process.
+  This technique was used by adversaries or threat actor to execute their malicious
+  payload in local or remote host. This hunting query is a good pivot to start to
+  look further which process trigger the wmi or what process it execute locally or
+  remotely.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process
+  = "* process *" Processes.process = "* call *" Processes.process = "* create *"
+  by Processes.parent_process_name Processes.parent_process Processes.process_name
+  Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_path
+  Processes.process_guid Processes.parent_process_id Processes.dest Processes.user
+  Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_wmi_process_call_create_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Administrators may execute this command for testing or auditing.
+references:
+- https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml
+- https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md
+tags:
+  analytic_story:
+  - Suspicious WMI Use
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: process with $process$ commandline executed in $dest$
+  mitre_attack_id:
+  - T1047
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.process_guid
+  risk_score: 25
+  security_domain: endpoint

detections/endpoint/wsreset_uac_bypass.yml

@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Living Off The Land
   confidence: 90
   context:
   - Source:Endpoint

detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml

@@ -0,0 +1,78 @@
+name: Windows WSReset UAC Bypass
+id: 3118f0c2-90d9-11ec-b833-acde48001122
+version: 1
+date: '2022-02-18'
+author: Lou Stella, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Registry
+description: This analytic is built to detect a suspicious modification of the Windows
+  registry related to UAC bypass. This technique is to modify the registry in this
+  detection, create a registry value with the path of the payload and run WSreset.exe
+  to bypass User Account Control.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)),
+  registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)),
+  registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string",
+  null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"),
+  "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"),
+  "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"),
+  "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"),
+  "string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT
+  NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%")
+  AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") |
+  eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive",
+  registry_hive, "registry_value_name", registry_value_name, "registry_key_name",
+  registry_key_name, "registry_value_type", registry_value_type, "registry_value_data",
+  registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events(); '
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Registry` datamodel.
+known_false_positives: Unknown at this point in time.
+references:
+- https://github.com/hfiref0x/UACME
+- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass
+tags:
+  analytic_story:
+  - Living Off The Land
+  - Windows Defense Evasion Tactics
+  cis20:
+  - CIS 14
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
+  impact: 70
+  kill_chain_phases:
+  - Privilege Escalation
+  message: null
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  nist:
+  - DE.AE
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - registry_path
+  - registry_hive
+  - registry_value_name
+  - registry_key_name
+  - registry_value_type
+  - registry_value_data
+  - process_guid
+  risk_score: 63
+  risk_severity: medium
+  security_domain: endpoint

detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml

@@ -11,25 +11,26 @@ description: Insider might conduct information collection before data exfiltrati
   potential threat. This detection evaluates the total bytes downloaded from internal
   servers at specific time window per entity level, and then flagged these that are
   higher than 99.999% percentile as an anamaly. A behavior will be reported as long
-  as the downloaded byte volume is unusual even though that operation is benigh, which
+  as the downloaded byte volume is unusual even though that operation is benign, which
   causes false positive. It is therefore advised to adjust threshold and time window
   based on detection performance whenever necessary. It should be noted that seasonality
   is not modeled in the current approach.
 search: '| from read_ssa_enriched_events() | eval sourcetype = ucast(map_get(input_event,
   "sourcetype"), "string", null) | eval timestamp = parse_long(ucast(map_get(input_event,
   "_time"), "string", null)) | where sourcetype == "pan:traffic" | eval src_device_scope
-  = map_get(input_event, "src_device_scope") | eval dest_device_scope = map_get(input_event,
-  "src_device_scope") | where src_device_scope IS NOT NULL AND dest_device_scope IS
-  NOT NULL | eval dest_device = map_get(input_event, "dest_device_ips") | where dest_device
-  IS NOT NULL AND dest_device_scope == "INTERNAL" | eval src_device = map_get(input_event,
-  "source_device_ips") | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
-  | eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string",
-  null)) | where download_bytes IS NOT NULL | eval tenant = map_get(input_event, "_tenant"),
-  event_id = map_get(input_event, "event_id") | adaptive_threshold algorithm="quantile"
-  value="download_bytes" entity="dest_device" threshold=0.001 window=86400L | eval
-  end_time = timestamp | eval start_time = end_time - 86400 | eval body = create_map(["event_id",
-  event_id, "tenant", tenant]) | select start_time, end_time, dest_device, label,
-  body | into write_ssa_detected_events();'
+  =ucast(map_get(input_event, "src_device_scope"), "string", null) | eval dest_device_scope=ucast(map_get(input_event,
+  "dest_device_scope"), "string", null) | where src_device_scope IS NOT NULL AND dest_device_scope
+  IS NOT NULL | eval dest_device = ucast(map_get(input_event, "dest_device_ips"),
+  "collection<string>", [])[0] | where dest_device IS NOT NULL AND dest_device_scope
+  == "INTERNAL" | eval src_device  = ucast(map_get(input_event, "src_device_ips"),
+  "collection<string>", [])[0] | where src_device IS NOT NULL AND src_device_scope
+  == "INTERNAL" | eval bytes_in = ucast(map_get(input_event, "bytes_in"), "integer",
+  0) | eval download_bytes = cast(bytes_in, "double") | eval tenant = ucast(map_get(input_event,
+  "_tenant"), "string", null) | eval event_id = ucast(map_get(input_event, "event_id"),
+  "string", null) | adaptive_threshold algorithm="quantile" value="download_bytes"
+  entity="dest_device" window=86400000L | where label AND quantile>0.99999 | eval
+  end_time = timestamp | eval start_time = end_time - 86400000 | eval body = create_map(["event_id",
+  event_id, "tenant", tenant]) | eval entities=mvappend(dest_device) | into write_ssa_detected_events();'
 how_to_implement: Ingest PAN traffic logs
 known_false_positives: Benign large volume data download might be flagged as (false)
   positive.

detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml

@@ -0,0 +1,83 @@
+name: TCP Command and Scripting Interpreter Outbound LDAP Traffic
+id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449
+version: 1
+date: '2022-02-17'
+author: Jose Hernandez, Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Processes
+description: Malicious actors often abuse misconfigured LDAP servers or applications
+  that use the LDAP servers in organizations. Outbound LDAP traffic should not be
+  allowed outbound through your perimeter firewall. This search will help determine
+  if you have any LDAP connections to IP addresses outside of private (RFC1918) address
+  space.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"),
+  "collection<string>", [])[0] | where dest_port=389 OR dest_port=1389 OR dest_port=636
+  | where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip,
+  cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port,
+  "dest_ip", dest_ip]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on network traffic, specifically data that populates the Network_Traffic datamodel.
+  To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic
+  events.
+known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be
+  allowed outbound through your perimeter firewall. Please check those servers to
+  verify if the activity is legitimate.
+references:
+- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
+- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html
+- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a
+tags:
+  analytic_story:
+  - Log4Shell CVE-2021-44228
+  cis20:
+  - CIS 13
+  confidence: 70
+  context:
+  - Scope:Outbound
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
+  impact: 50
+  kill_chain_phases:
+  - Execution
+  message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting
+    to dest ip $dest_ip$
+  mitre_attack_id:
+  - T1059
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: low
+  security_domain: network

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.35.0"
+      "version": "3.36.0"
     }, 
     "author": [
       {

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-15T23:04:01 UTC
+# On Date: 2022-03-03T18:16:55 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -39,7 +39,7 @@ version = 2
 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
+searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Lambda UpdateFunctionCode - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.
 
@@ -80,6 +80,17 @@ description = Monitor for activities and techniques associated with Discovery an
 narrative = Discovery consists of techniques an adversay uses to gain knowledge about an internal environment or network. These techniques provide adversaries with situational awareness and allows them to have the necessary information before deciding how to act or who/what to target next.\
 Once an attacker obtains an initial foothold in an Active Directory environment, she is forced to engage in Discovery techniques in the initial phases of a breach to better understand and navigate the target network. Some examples include but are not limited to enumerating domain users, domain admins, computers, domain controllers, network shares, group policy objects, domain trusts, etc.
 
+[analytic_story://Active Directory Kerberos Attacks]
+category = Adversary Tactics
+last_updated = 2022-02-02
+version = 1
+references = ["https://en.wikipedia.org/wiki/Kerberos_(protocol)", "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9", "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html", "https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/", "https://attack.mitre.org/techniques/T1558/003/", "https://attack.mitre.org/techniques/T1550/003/", "https://attack.mitre.org/techniques/T1558/004/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
+spec_version = 3
+searches = ["ESCU - Disabled Kerberos Pre-Authentication Discovery With Get-ADUser - Rule", "ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled in UserAccountControl - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled with PowerShell - Rule", "ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule", "ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Rubeus Command Line Parameters - Rule", "ESCU - Rubeus Kerberos Ticket Exports Through Winlogon Access - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - Unusual Number of Kerberos Service Tickets Requested - Rule"]
+description = Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments.
+narrative = Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks since the introduction of Windows Server 2003. With Kerberos being the backbone of Windows authentication, it is commonly abused by adversaries across the different phases of a breach including initial access, privilege escalation, defense evasion, credential access, lateral movement, etc.\ This Analytic Story groups detection use cases in which the Kerberos protocol is abused. Defenders can leverage these analytics to detect and hunt for adversaries engaging in Kerberos based attacks.
+
 [analytic_story://Active Directory Lateral Movement]
 category = Adversary Tactics
 last_updated = 2021-12-09
@@ -87,7 +98,7 @@ version = 3
 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html", "http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco"]
 maintainers = [{"company": "Mauricio Velazco Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Randomly Generated Windows Service Name - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and Winrs - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Windows Service Created With Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Service Creation on Remote Endpoint - Rule", "ESCU - Windows Service Initiation on Remote Endpoint - Rule", "ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule", "ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
+searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Randomly Generated Windows Service Name - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and Winrs - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Windows Service Created With Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Creation on Remote Endpoint - Rule", "ESCU - Windows Service Initiation on Remote Endpoint - Rule", "ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule", "ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
 description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement is often a necessary step in a breach, it is important for cyber defenders to deploy detection coverage. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Delete Detected Files' 
 narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\
 Indications of lateral movement in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager, the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\
@@ -196,7 +207,7 @@ version = 1
 references = ["https://www.hhs.gov/sites/default/files/analyst-note-cl0p-tlp-white.pdf", "https://securityaffairs.co/wordpress/115250/data-breach/qualys-clop-ransomware.html", "https://www.darkreading.com/attacks-breaches/qualys-is-the-latest-victim-of-accellion-data-breach/d/d-id/1340323"]
 maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
-searches = ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High File Deletion Frequency - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Service Created With Suspicious Service Path - Rule"]
+searches = ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows High File Deletion Frequency - Rule", "ESCU - Windows Service Created With Suspicious Service Path - Rule"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, registry key modification, deleting of security logs, and more.
 narrative = Clop ransomware campaigns targeting healthcare and other vertical sectors, involve the use of ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data.
 
@@ -278,7 +289,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
+searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Lambda UpdateFunctionCode - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
 narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\
 Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists.
@@ -363,6 +374,17 @@ searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule",
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware
 narrative = This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.
 
+[analytic_story://Data Destruction]
+category = Malware
+last_updated = 2022-02-14
+version = 1
+references = ["https://attack.mitre.org/techniques/T1485/", "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/", "https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
+spec_version = 3
+searches = ["ESCU - Linux DD File Overwrite - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows File Without Extension In Critical Folder - Rule", "ESCU - Windows Raw Access To Disk Volume Partition - Rule"]
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the data destruction, including deleting files, overwriting files, wiping disk and encrypting files.
+narrative = Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal.
+
 [analytic_story://Data Exfiltration]
 category = Adversary Tactics
 last_updated = 2020-10-21
@@ -512,6 +534,17 @@ narrative = On Tuesday, March 2, 2021, Microsoft released a set of security patc
 While the CVEs do not shed much light on the specifics of the vulnerabilities or exploits, the first vulnerability (CVE-2021-26855) has a remote network attack vector that allows the attacker, a group Microsoft named HAFNIUM, to authenticate as the Exchange server. Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server. This includes the ability to run code as SYSTEM and write to any path on the server.\
 The following Splunk detections assist with identifying the HAFNIUM groups tradecraft and methodology.
 
+[analytic_story://Hermetic Wiper]
+category = Malware
+last_updated = 2022-03-02
+version = 1
+references = ["https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/", "https://www.cisa.gov/uscert/ncas/alerts/aa22-057a"]
+maintainers = [{"company": "Rod Soto, Michael Haag, Splunk", "email": "-", "name": "Teoderick Contreras"}]
+spec_version = 3
+searches = ["ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows File Without Extension In Critical Folder - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Raw Access To Disk Volume Partition - Rule", "ESCU - Windows Raw Access To Master Boot Record Drive - Rule"]
+description = This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more.
+narrative = Hermetic Wiper is destructive malware operation found by Sentinel One targeting multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction.
+
 [analytic_story://Hidden Cobra Malware]
 category = Malware
 last_updated = 2020-01-22
@@ -606,6 +639,17 @@ searches = ["ESCU - Linux Add Files In Known Crontab Directories - Rule", "ESCU
 description = Monitor for activities and techniques associated with maintaining persistence on a Linux system--a sign that an adversary may have compromised your environment.
 narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Linux environment.
 
+[analytic_story://Linux Post-Exploitation]
+category = Adversary Tactics
+last_updated = 2021-12-03
+version = 1
+references = ["https://attack.mitre.org/matrices/enterprise/linux/"]
+maintainers = [{"company": "no", "email": "-", "name": "Rod Soto"}]
+spec_version = 3
+searches = ["ESCU - Suspicious Linux Discovery Commands - Rule"]
+description = This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin.
+narrative = These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version.
+
 [analytic_story://Linux Privilege Escalation]
 category = Adversary Tactics
 last_updated = 2021-12-17
@@ -617,6 +661,17 @@ searches = ["ESCU - Linux Add Files In Known Crontab Directories - Rule", "ESCU
 description = Monitor for and investigate activities that may be associated with a Linux privilege-escalation attack, including unusual processes running on endpoints, schedule task, services, setuid, root execution and more.
 narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Linux machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment.
 
+[analytic_story://Living Off The Land]
+category = Adversary Tactics
+last_updated = 2022-02-17
+version = 1
+references = ["https://lolbas-project.github.io/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
+spec_version = 3
+searches = ["ESCU - Eventvwr UAC Bypass - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule"]
+description = Leverage searches that allow you to search for the presence of an attacker leveraging existing tooling within your environment.
+narrative = Living Off The Land refers to an attacker methodology of using software already installed on their target host to achieve their goals. Many utilities that ship with Windows can be used to achieve various goals, with reduced chances of detection by an antivirus software.
+
 [analytic_story://Log4Shell CVE-2021-44228]
 category = Adversary Tactics
 last_updated = 2021-12-11
@@ -624,8 +679,8 @@ version = 1
 references = ["https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/", "https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j", "https://www.crowdstrike.com/blog/log4j2-vulnerability-analysis-and-mitigation-recommendations/", "https://www.lunasec.io/docs/blog/log4j-zero-day/", "https://www.splunk.com/en_us/blog/security/log-jammin-log4j-2-rce.html"]
 maintainers = [{"company": "no", "email": "-", "name": "Jose Hernandez"}]
 spec_version = 3
-searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Curl Download and Bash Execution - Rule", "ESCU - Detect Outbound LDAP Traffic - Rule", "ESCU - Hunting for Log4Shell - Rule", "ESCU - Java Class File download by Java User Agent - Rule", "ESCU - Linux Java Spawning Shell - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule", "ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule", "ESCU - Outbound Network Connection from Java Using Default Ports - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Wget Download and Bash Execution - Rule", "ESCU - Windows Java Spawning Shells - Rule"]
-description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Respond', 'Log4j Splunk Investigation' 
+searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Curl Download and Bash Execution - Rule", "ESCU - Detect Outbound LDAP Traffic - Rule", "ESCU - Hunting for Log4Shell - Rule", "ESCU - Java Class File download by Java User Agent - Rule", "ESCU - Linux Java Spawning Shell - Rule", "ESCU - Log4Shell CVE-2021-44228 Exploitation - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule", "ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule", "ESCU - Outbound Network Connection from Java Using Default Ports - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Wget Download and Bash Execution - Rule", "ESCU - Windows Java Spawning Shells - Rule"]
+description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Respond', 'Log4j Investigate', 'Log4j Splunk Investigation' 
 narrative = In late November 2021, Chen Zhaojun of Alibaba identified a remote code execution vulnerability. Previous work was seen in a 2016 Blackhat talk by Alvaro Munoz and Oleksandr Mirosh called ["A Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land"](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf). Reported under the CVE ID : CVE-2021-44228, released to the public on December 10, 2021. The vulnerability is exploited through improper deserialization of user input passed into the framework. It permits remote code execution and it can allow an attacker to leak sensitive data, such as environment variables, or execute malicious software on the target system.
 
 [analytic_story://Malicious PowerShell]
@@ -725,6 +780,17 @@ description = Detect activities and various techniques associated with the abuse
 narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\
 To get started, run the detection search to identify parent processes of `netsh.exe`.
 
+[analytic_story://Network Discovery]
+category = Malware
+last_updated = 2022-02-14
+version = 1
+references = ["https://attack.mitre.org/techniques/T1016/", "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf", "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
+spec_version = 3
+searches = ["ESCU - Linux System Network Discovery - Rule"]
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the network discovery, including looking for network configuration, settings such as IP, MAC address, firewall settings and many more.
+narrative = Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
+
 [analytic_story://Office 365 Detections]
 category = Cloud Security
 last_updated = 2020-12-16
@@ -848,7 +914,7 @@ version = 1
 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"]
+searches = ["ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Ransomware Investigate and Contain' 
 narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.
 
@@ -1011,7 +1077,7 @@ version = 1
 references = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
+searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Lambda UpdateFunctionCode - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).
 narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \
 Amazon's VPC service enables you to launch EC2 instances and leverage other Amazon resources. The traffic that flows in and out of this VPC can be controlled via network access-control rules and security groups. Amazon also has a feature called VPC Flow Logs that enables you to log IP traffic going to and from the network interfaces in your VPC. This data is stored using Amazon CloudWatch Logs.\
@@ -1060,7 +1126,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
+searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Lambda UpdateFunctionCode - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
 description = Detect and investigate suspicious activities by users and roles in your cloud environments.
 narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
 In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage.
@@ -1203,7 +1269,7 @@ version = 2
 references = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - WMIC XSL Execution via URL - Rule", "ESCU - XSL Script Execution With WMIC - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
+searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - WMIC XSL Execution via URL - Rule", "ESCU - Windows WMI Process Call Create - Rule", "ESCU - XSL Script Execution With WMIC - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
 description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.
 narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems. In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end.
 
@@ -1214,7 +1280,7 @@ version = 1
 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.
 narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\
  The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\
@@ -1310,7 +1376,7 @@ version = 1
 references = ["https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/", "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
 spec_version = 3
-searches = ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Excessive File Deletion In WinDefender Folder - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - High File Deletion Frequency - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Ping Sleep Batch Command - Rule", "ESCU - Powershell Remove Windows Defender Directory - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Suspicious Process DNS Query Known Abuse Web Services - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Process With Discord DNS Query - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows NirSoft Utilities - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule"]
+searches = ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Excessive File Deletion In WinDefender Folder - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Ping Sleep Batch Command - Rule", "ESCU - Powershell Remove Windows Defender Directory - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Suspicious Process DNS Query Known Abuse Web Services - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Process With Discord DNS Query - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows High File Deletion Frequency - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows NirSoft Utilities - Rule", "ESCU - Windows Raw Access To Master Boot Record Drive - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule"]
 description = This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic story looks for suspicious process execution, command-line activity, downloads, DNS queries and more.
 narrative = WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, overwrite or destroy master boot record (MBR) of the targeted host, wiper and also windows defender evasion techniques.
 
@@ -1332,7 +1398,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.
 
@@ -1370,7 +1436,7 @@ version = 2
 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
 narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.
 
@@ -1656,6 +1722,16 @@ annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": [
 known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
 providing_technologies = []
 
+[savedsearch://ESCU - AWS Lambda UpdateFunctionCode - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = This analytic is designed to detect IAM users attempting to update/modify AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS environment and to facilitate planting backdoors. In this instance, an attacker may upload malicious code/binary to a lambda function which will be executed automatically when the funnction is triggered.
+how_to_implement = You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = While this search has no known false positives, it is possible that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
+providing_technologies = []
+
 [savedsearch://ESCU - AWS Network Access Control List Created with All Open Ports - Rule]
 type = detection
 asset_type = AWS Instance
@@ -3849,6 +3925,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00
 known_false_positives = admin or user may choose to disable this windows features.
 providing_technologies = []
 
+[savedsearch://ESCU - Disabled Kerberos Pre-Authentication Discovery With Get-ADUser - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1558", "T1558.004"]}
+known_false_positives = Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes.
+providing_technologies = []
+
+[savedsearch://ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks. As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired` allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1558", "T1558.004"]}
+known_false_positives = Administrators or power users may use PowerView for troubleshooting
+providing_technologies = []
+
 [savedsearch://ESCU - Disabling CMD Application - Rule]
 type = detection
 asset_type = 
@@ -5190,16 +5286,6 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"
 known_false_positives = Some applications and users may legitimately use attrib.exe to interact with the files. 
 providing_technologies = []
 
-[savedsearch://ESCU - High File Deletion Frequency - Rule]
-type = detection
-asset_type = 
-confidence = medium
-explanation = This search looks for high frequency of file deletion relative to process name and process id. These events usually happen when the ransomware tries to encrypt the files with the ransomware file extensions and sysmon treat the original files to be deleted as soon it was replace as encrypted data.
-how_to_implement = To successfully implement this search, you need to be ingesting logs with the deleted target file name, process name and process id  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"]}
-known_false_positives = user may delete bunch of pictures or files in a folder.
-providing_technologies = []
-
 [savedsearch://ESCU - High Frequency Copy Of Files In Network Share - Rule]
 type = detection
 asset_type = 
@@ -5344,10 +5430,30 @@ providing_technologies = []
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This search detects a potential kerberoasting attack via service principal name requests
-how_to_implement = You must be ingesting endpoint data that tracks process activity, and include the windows security event logs that contain kerberos
-annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1558.003", "T1558"], "nist": ["DE.CM"]}
-known_false_positives = Older systems that support kerberos RC4 by default NetApp may generate false positives
+explanation = The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and attempt to crack them offline allowing them to obtain privileged access to the domain. This analytic looks for a specific combination of the Ticket_Options field based on common kerberoasting tools. Defenders should be aware that it may be possible for a Kerberoast attack to use different Ticket_Options.
+how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1558", "T1558.003"], "nist": ["DE.CM"]}
+known_false_positives = Older systems that support kerberos RC4 by default like NetApp may generate false positives. Filter as needed
+providing_technologies = []
+
+[savedsearch://ESCU - Kerberos Pre-Authentication Flag Disabled in UserAccountControl - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic leverages Windows Security Event 4738, `A user account was changed`, to identify a change performed on a domain user object that disables Kerberos Pre-Authentication. Disabling the Pre Authentication flag in the UserAccountControl property allows an adversary to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique. Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor or a way to escalate privileges.
+how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled.
+annotations = {"kill_chain_phases": ["Intrusion", "Privilege Escalation"], "mitre_attack": ["T1558", "T1558.004"]}
+known_false_positives = Unknown.
+providing_technologies = []
+
+[savedsearch://ESCU - Kerberos Pre-Authentication Flag Disabled with PowerShell - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Set-ADAccountControl` commandlet with specific parameters. `Set-ADAccountControl` is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. As the name suggests, `Set-ADAccountControl` is used to modify User Account Control values for an Active Directory domain account. With the appropiate parameters, Set-ADAccountControl allows adversaries to disable Kerberos Pre-Authentication for an account to to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique. Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor or a way to escalate privileges.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Intrusion", "Privilege Escalation"], "mitre_attack": ["T1558", "T1558.004"]}
+known_false_positives = Although unlikely, Administrators may need to set this flag for legitimate purposes.
 providing_technologies = []
 
 [savedsearch://ESCU - Known Services Killed by Ransomware - Rule]
@@ -5650,6 +5756,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Pri
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 providing_technologies = []
 
+[savedsearch://ESCU - Linux DD File Overwrite - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic is to look for dd command to overwrite file. This technique was abused by adversaries or threat actor to destroy files or data on specific system or in a large number of host within network to interrupt host avilability, services and many more. This is also used to destroy data where it make the file irrecoverable by forensic techniques through overwriting files, data or local and remote drives.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"]}
+known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
+providing_technologies = []
+
 [savedsearch://ESCU - Linux Doas Conf File Creation - Rule]
 type = detection
 asset_type = 
@@ -5910,6 +6026,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Pri
 known_false_positives = administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 providing_technologies = []
 
+[savedsearch://ESCU - Linux System Network Discovery - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic is to look for possible enumeration of local network configuration. This technique is commonly used as part of recon of adversaries or threat actor to know some network information for its next or further attack. This anomaly detections may capture normal event made by administrator during auditing or testing network connection of specific host or network to network.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1016"], "nist": ["DE.CM"]}
+known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
+providing_technologies = []
+
 [savedsearch://ESCU - Linux Visudo Utility Execution - Rule]
 type = detection
 asset_type = 
@@ -5960,6 +6086,16 @@ annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087"
 known_false_positives = Administrators or power users may use this command for troubleshooting.
 providing_technologies = []
 
+[savedsearch://ESCU - Log4Shell CVE-2021-44228 Exploitation - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
+how_to_implement = To implement this correlation search a user needs to enable all detections in the Log4Shell Analytic Story and confirm it is generation risk events. A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Exploitation", "Lateral Movement"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"]}
+known_false_positives = There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation.
+providing_technologies = []
+
 [savedsearch://ESCU - Log4Shell JNDI Payload Injection Attempt - Rule]
 type = detection
 asset_type = 
@@ -6138,6 +6274,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505",
 known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
 providing_technologies = []
 
+[savedsearch://ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Defenders should be aware that adversaries may customize the source code of Mimikatz and modify the command line parameters. This would effectively bypass this analytic.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1550", "T1550.003"]}
+known_false_positives = Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz.
+providing_technologies = []
+
 [savedsearch://ESCU - Mmc LOLBAS Execution Process Spawn - Rule]
 type = detection
 asset_type = 
@@ -7604,6 +7750,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]}
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - Rubeus Command Line Parameters - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized in common Kerberos attacks like exporting and importing tickets, forging silver and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory networks. Defenders should be aware that adversaries may customize the source code of Rubeus and modify the command line parameters. This would effectively bypass this analytic.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1550", "T1550.003", "T1558", "T1558.003", "T1558.004"]}
+known_false_positives = Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Rubeus Kerberos Ticket Exports Through Winlogon Access - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior when using the Rubeus tool to monitor for and export kerberos tickets from memory. Before being able to export tickets. Rubeus will try to escalate privileges to SYSTEM by obtaining a handle to winlogon.exe before trying to monitor for kerberos tickets. Exporting tickets from memory is typically the first step for pass the ticket attacks. Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic.
+how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment.
+annotations = {"kill_chain_phases": ["Privilege Escalation", "Lateral Movement"], "mitre_attack": ["T1550", "T1550.003"]}
+known_false_positives = Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
+providing_technologies = []
+
 [savedsearch://ESCU - RunDLL Loading DLL By Ordinal - Rule]
 type = detection
 asset_type = Endpoint
@@ -7851,10 +8017,10 @@ providing_technologies = []
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This search looks for flags passed to schtasks.exe on the command-line that indicate a task was created via command like. This has been associated with the Dragonfly threat actor, and the SUNBURST attack against Solarwinds.
-how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
+explanation = The following analytic identifies the creation or deletion of a scheduled task using schtasks.exe with flags - create or delete being passed on the command-line. This has been associated with the Dragonfly threat actor, and the SUNBURST attack against Solarwinds. This analytic replaces "Scheduled Task used in BadRabbit Ransomware".
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"]}
-known_false_positives = Tasks should not be manually created via CLI, this is rarely done by admins as well
+known_false_positives = It is possible scripts or administrators may trigger this analytic. Filter as needed based on parent process, application.
 providing_technologies = []
 
 [savedsearch://ESCU - Scheduled Task Initiation on Remote Endpoint - Rule]
@@ -7994,7 +8160,7 @@ Values \
 1. -F = perform queries at the forest, rather than domain level 1. -T = perform query on the specified domain or forest (when -F is also used) 1. -Q = query for existence of SPN \
 During triage, review parallel processes for further suspicious activity.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1558.003"]}
+annotations = {"kill_chain_phases": ["Privilege Escalation", "Active Directory Kerberos Attacks"], "mitre_attack": ["T1558.003"]}
 known_false_positives = False positives may be caused by Administrators resetting SPNs or querying for SPNs. Filter as needed.
 providing_technologies = []
 
@@ -8360,6 +8526,17 @@ annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["
 known_false_positives = We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, they may be possible in certain environments. Filter as needed.
 providing_technologies = []
 
+[savedsearch://ESCU - Suspicious Linux Discovery Commands - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search, detects execution of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of possible paths of privilege execution, password files, vulnerable directories, executables and file permissions on a Linux host.\
+The search logic specifically looks for high number of distinct commands run in a short period of time.
+how_to_implement = This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.004"]}
+known_false_positives = Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored.
+providing_technologies = []
+
 [savedsearch://ESCU - Suspicious MSBuild Rename - Rule]
 type = detection
 asset_type = Endpoint
@@ -8849,6 +9026,17 @@ annotations = {"kill_chain_phases": ["Reconnaissance", "Exploitation", "Lateral
 known_false_positives = An single endpoint requesting a large number of computer service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systeams and missconfigured systems.
 providing_technologies = []
 
+[savedsearch://ESCU - Unusual Number of Kerberos Service Tickets Requested - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and attempt to crack them offline allowing them to obtain privileged access to the domain.\
+The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number service ticket requests. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field.
+how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1558", "T1558.003"]}
+known_false_positives = An single endpoint requesting a large number of kerberos service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
+providing_technologies = []
+
 [savedsearch://ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule]
 type = detection
 asset_type = 
@@ -9209,6 +9397,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00
 known_false_positives = admin or user may choose to use this windows features.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Disable Memory Crash Dump - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies a process that is attempting to disable the ability on Windows to generate a memory crash dump. This was recently identified being utilized by HermeticWiper. To disable crash dumps, the value must be set to 0. This feature is typically modified to perform a memory crash dump when a computer stops unexpectedly because of a Stop error (also known as a blue screen, system crash, or bug check).
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` node.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Windows DisableAntiSpyware Registry - Rule]
 type = detection
 asset_type = Endpoint
@@ -9229,6 +9427,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]}
 known_false_positives = It is possible false positives may be present based on the internal name dcinst.exe, filter as needed. It may be worthy to alert on the service name.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Diskshadow Proxy Execution - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a scripting mode intended for complex scripted backup operations. This feature also allows for execution of arbitrary unsigned code. This analytic looks for the usage of the scripting mode flags in executions of DiskShadow. During triage, compare to known backup behavior in your environment and then review the scripts called by diskshadow.
+how_to_implement = To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218"], "nist": ["DE.CM"]}
+known_false_positives = Administrators using the DiskShadow tool in their infrastructure as a main backup tool with scripts will cause false positives that can be filtered with `windows_diskshadow_proxy_execution_filter`
+providing_technologies = []
+
 [savedsearch://ESCU - Windows DotNet Binary in Non Standard Path - Rule]
 type = detection
 asset_type = 
@@ -9239,6 +9447,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036",
 known_false_positives = False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Event For Service Disabled - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will identify suspicious system event of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services to evade the defense systems on the compromised host
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
+known_false_positives = Windows service update may cause this event. In that scenario, filtering is needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows Event Log Cleared - Rule]
 type = detection
 asset_type = Endpoint
@@ -9249,6 +9467,36 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Acti
 known_false_positives = It is possible that these logs may be legitimately cleared by Administrators. Filter as needed.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Excessive Disabled Services Event - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will identify suspicious excessive number of system events of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services oer serve as an destructive impact to complete the objective on the compromised system. One good example for this scenario is Olympic destroyer where it disable all active services in the compromised host as part of its destructive impact and defense evasion.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
+known_false_positives = Unknown
+providing_technologies = []
+
+[savedsearch://ESCU - Windows File Without Extension In Critical Folder - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic is to look for suspicious file creation in the critical folder like "System32\Drivers" folder without file extension. This artifacts was seen in latest hermeticwiper where it drops its driver component in Driver Directory both the compressed(without file extension) and the actual driver component (with .sys file extension). This TTP is really a good indication that a host might be compromised by this destructive malware that wipes the boot sector of the system.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"]}
+known_false_positives = Unknown at this point
+providing_technologies = []
+
+[savedsearch://ESCU - Windows High File Deletion Frequency - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search looks for high frequency of file deletion relative to process name and process id. These events usually happen when the ransomware tries to encrypt the files with the ransomware file extensions and sysmon treat the original files to be deleted as soon it was replace as encrypted data.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the deleted target file name, process name and process id  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"]}
+known_false_positives = user may delete bunch of pictures or files in a folder.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows Hunting System Account Targeting Lsass - Rule]
 type = detection
 asset_type = 
@@ -9346,6 +9594,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 known_false_positives = Filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on that.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic is to look for suspicious registry modification related to file compression color and information tips. This IOC was seen in hermetic wiper where it has a thread that will create this registry entry to change the color of compressed or encrypted files in NTFS file system as well as the pop up information tips. This is a good indicator that a process tries to modified one of the registry GlobalFolderOptions related to file compression attribution in terms of color in NTFS file system.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Windows NirSoft AdvancedRun - Rule]
 type = detection
 asset_type = 
@@ -9390,6 +9648,16 @@ annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": [
 known_false_positives = False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Process With NamedPipe CommandLine - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic is to look for process commandline that contains named pipe. This technique was seen in some adversaries, threat actor and malware like olympic destroyer to communicate to its other child processes after process injection that serve as defense evasion and privilege escalation. On the other hand this analytic may catch some normal process that using this technique for example browser application. In that scenario we include common process path we've seen during testing that cause false positive which is the program files. False positive may still be arise if the normal application is in other folder path.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]}
+known_false_positives = Normal browser application may use this technique. Please update the filter macros to remove false positives.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows Raccine Scheduled Task Deletion - Rule]
 type = detection
 asset_type = 
@@ -9410,6 +9678,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055.00
 known_false_positives = False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Raw Access To Disk Volume Partition - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic is to look for suspicious raw access read to device disk partition of the host machine. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the boot sector of each partition as part of their impact payload for example the "hermeticwiper" malware. This detection is a good indicator that there is a process try to read or write on boot sector.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1561.002", "T1561"], "nist": ["DE.CM"]}
+known_false_positives = This event is really notable but we found minimal number of normal application from system32 folder like svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection.
+providing_technologies = []
+
+[savedsearch://ESCU - Windows Raw Access To Master Boot Record Drive - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic is to look for suspicious raw access read to drive where the master boot record is placed. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1561.002", "T1561"], "nist": ["DE.CM"]}
+known_false_positives = This event is really notable but we found minimal number of normal application from system32 folder like svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows Remote Assistance Spawning Process - Rule]
 type = detection
 asset_type = 
@@ -9460,6 +9748,16 @@ annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T154
 known_false_positives = Legitimate applications may install services with uncommon services paths.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Service Creation Using Registry Entry - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic is to look for suspicious modification or creation of registry to have service entry. This technique is abused by adversaries or threat actor to persist, gain privileges in the machine or even lateral movement. This technique can be executed using reg.exe application or using windows API like for example the CrashOveride malware. This detection is a good indicator that a process is trying to create a service entry using registry ImagePath.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.011"], "nist": ["DE.CM"]}
+known_false_positives = Third party tools may used this technique to create services but not so common.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows Service Creation on Remote Endpoint - Rule]
 type = detection
 asset_type = 
@@ -9480,6 +9778,16 @@ annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T154
 known_false_positives = Administrators may start Windows Services on remote systems, but this activity is usually limited to a small set of hosts or users.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows WMI Process Call Create - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic is to look for wmi commandlines to execute or create process. This technique was used by adversaries or threat actor to execute their malicious payload in local or remote host. This hunting query is a good pivot to start to look further which process trigger the wmi or what process it execute locally or remotely.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1047"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may execute this command for testing or auditing.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows connhost exe started forcefully - Rule]
 type = detection
 asset_type = Endpoint

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 5376
+build = 6178
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.35.0
+version = 3.36.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-15T23:04:01 UTC
+# On Date: 2022-03-03T18:16:55 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 3.35.0
+version = 3.36.0

dist/escu/default/es_investigations.conf

@@ -41,6 +41,13 @@ disabled = 0
 
 panels = ["panel://workbench_panel_get_notable_history___response_task"]
 
+[panel_group://workbench_panel_group_active_directory_kerberos_attacks]
+label = Active Directory Kerberos Attacks
+description = Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments.
+disabled = 0
+
+panels = ["panel://workbench_panel_get_notable_history___response_task"]
+
 [panel_group://workbench_panel_group_active_directory_lateral_movement]
 label = Active Directory Lateral Movement
 description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement is often a necessary step in a breach, it is important for cyber defenders to deploy detection coverage. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Delete Detected Files' 
@@ -188,6 +195,13 @@ disabled = 0
 
 panels = ["panel://workbench_panel_get_notable_history___response_task"]
 
+[panel_group://workbench_panel_group_data_destruction]
+label = Data Destruction
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the data destruction, including deleting files, overwriting files, wiping disk and encrypting files.
+disabled = 0
+
+panels = ["panel://workbench_panel_get_notable_history___response_task"]
+
 [panel_group://workbench_panel_group_data_exfiltration]
 label = Data Exfiltration
 description = The stealing of data by an adversary.
@@ -279,6 +293,13 @@ disabled = 0
 
 panels = ["panel://workbench_panel_get_notable_history___response_task"]
 
+[panel_group://workbench_panel_group_hermetic_wiper]
+label = Hermetic Wiper
+description = This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more.
+disabled = 0
+
+panels = ["panel://workbench_panel_get_notable_history___response_task"]
+
 [panel_group://workbench_panel_group_hidden_cobra_malware]
 label = Hidden Cobra Malware
 description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
@@ -328,6 +349,13 @@ disabled = 0
 
 panels = ["panel://workbench_panel_get_notable_history___response_task"]
 
+[panel_group://workbench_panel_group_linux_post_exploitation]
+label = Linux Post-Exploitation
+description = This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin.
+disabled = 0
+
+panels = ["panel://workbench_panel_get_notable_history___response_task"]
+
 [panel_group://workbench_panel_group_linux_privilege_escalation]
 label = Linux Privilege Escalation
 description = Monitor for and investigate activities that may be associated with a Linux privilege-escalation attack, including unusual processes running on endpoints, schedule task, services, setuid, root execution and more.
@@ -335,9 +363,16 @@ disabled = 0
 
 panels = ["panel://workbench_panel_get_notable_history___response_task"]
 
+[panel_group://workbench_panel_group_living_off_the_land]
+label = Living Off The Land
+description = Leverage searches that allow you to search for the presence of an attacker leveraging existing tooling within your environment.
+disabled = 0
+
+panels = ["panel://workbench_panel_get_notable_history___response_task"]
+
 [panel_group://workbench_panel_group_log4shell_cve_2021_44228]
 label = Log4Shell CVE-2021-44228
-description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Respond', 'Log4j Splunk Investigation' 
+description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Respond', 'Log4j Investigate', 'Log4j Splunk Investigation' 
 disabled = 0
 
 panels = ["panel://workbench_panel_get_notable_history___response_task"]
@@ -391,6 +426,13 @@ disabled = 0
 
 panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]
 
+[panel_group://workbench_panel_group_network_discovery]
+label = Network Discovery
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the network discovery, including looking for network configuration, settings such as IP, MAC address, firewall settings and many more.
+disabled = 0
+
+panels = ["panel://workbench_panel_get_notable_history___response_task"]
+
 [panel_group://workbench_panel_group_office_365_detections]
 label = Office 365 Detections
 description = This story is focused around detecting Office 365 Attacks.

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-15T23:04:01 UTC
+# On Date: 2022-03-03T18:16:55 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -306,6 +306,10 @@ description = Matches the process with its original file name, data for this mac
 definition = (Processes.process_name=curl.exe OR Processes.original_file_name=Curl.exe)
 description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
 
+[process_diskshadow]
+definition = (Processes.process_name=diskshadow.exe OR Processes.original_file_name=diskshadow.exe)
+description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+
 [process_dllhost]
 definition = (Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)
 description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
@@ -647,6 +651,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[aws_lambda_updatefunctioncode_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [aws_network_acl_details_from_id_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1591,6 +1599,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabled_kerberos_pre_authentication_discovery_with_powerview_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [disabling_cmd_application_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2227,10 +2243,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
-[high_file_deletion_frequency_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
 [high_frequency_copy_of_files_in_network_share_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2351,6 +2363,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kerberos_pre_authentication_flag_disabled_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [known_services_killed_by_ransomware_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2471,6 +2491,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[linux_dd_file_overwrite_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [linux_doas_conf_file_creation_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2575,6 +2599,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[linux_system_network_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [linux_visudo_utility_execution_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2595,6 +2623,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[log4shell_cve_2021_44228_exploitation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [log4shell_jndi_payload_injection_attempt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2663,6 +2695,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[mimikatz_passtheticket_commandline_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [mmc_lolbas_execution_process_spawn_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -3371,6 +3407,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[rubeus_command_line_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rubeus_kerberos_ticket_exports_through_winlogon_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [rundll_loading_dll_by_ordinal_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -3671,6 +3715,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[suspicious_linux_discovery_commands_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [suspicious_msbuild_rename_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -3863,6 +3911,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[unusual_number_of_kerberos_service_tickets_requested_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [unusual_number_of_remote_endpoint_authentication_events_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -4003,6 +4055,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_disable_memory_crash_dump_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_disableantispyware_registry_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -4011,14 +4067,34 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_diskshadow_proxy_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_dotnet_binary_in_non_standard_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_event_for_service_disabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_event_log_cleared_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_excessive_disabled_services_event_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_file_without_extension_in_critical_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_high_file_deletion_frequency_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_hunting_system_account_targeting_lsass_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -4051,6 +4127,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_modify_show_compress_color_and_info_tip_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_nirsoft_advancedrun_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -4067,6 +4147,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_process_with_namedpipe_commandline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_raccine_scheduled_task_deletion_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -4075,6 +4159,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_raw_access_to_disk_volume_partition_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_raw_access_to_master_boot_record_drive_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_remote_assistance_spawning_process_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -4095,6 +4187,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_service_creation_using_registry_entry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_service_creation_on_remote_endpoint_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -4111,6 +4207,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_wmi_process_call_create_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_connhost_exe_started_forcefully_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-15T23:04:01 UTC
+# On Date: 2022-03-03T18:16:54 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -114,6 +114,14 @@ min_matches = 1
 filename = legit_domains.csv
 # description = A list of legit domains to be used as an ignore list for possible phishing sites
 
+[linux_tool_discovery_process]
+filename = linux_tool_discovery_process.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of suspicious bash commonly used by attackers via scripts
+match_type = WILDCARD(process)
+min_matches = 1
+
 [local_file_inclusion_paths]
 filename = local_file_inclusion_paths.csv
 default_match = false

dist/escu/lookups/linux_tool_discovery_process.csv

@@ -0,0 +1,61 @@
+process
+cat /proc/version
+cat /etc/*-release
+/etc/passwd 
+cat /etc/*
+lastlog 
+id
+PermitRootLogin
+sestatus *
+ps
+mysql*
+netstat*
+find *
+head /var/mail/root
+docker
+cat /etc/issue
+cat /etc/*-release
+cat /proc/version
+uname -a
+uname -mrs
+rpm -q kernel
+dmesg | grep Linux
+ls /boot | grep vmlinuz-
+cat /etc/profile
+cat /etc/bashrc
+cat ~/.bash_profile
+cat ~/.bashrc
+cat ~/.bash_logout
+ps -aux | grep root
+ps -ef | grep root
+crontab -l
+cat /etc/cron*
+cat /etc/cron.allow
+cat /etc/cron.deny
+cat /etc/crontab
+grep -i user *
+grep -i pass *
+ifconfig
+cat /etc/network/interfaces
+cat /etc/sysconfig/network
+cat /etc/resolv.conf
+cat /etc/networks
+cvelist-file:*
+exploit-db*
+strings -e /etc/apache2/apache2.conf
+strings -e /etc/ssh/sshd_config
+strings -e /etc/shadow
+iptables -L
+lsof -i
+netstat -antup
+netstat -antpx
+netstat -tulpn
+arp -e
+route
+cat /etc/passwd
+cat /etc/group
+cat /etc/shadow
+find / -perm -u=s
+find / -perm -g=s
+find / -perm -4000
+find / -perm -2000

dist/escu/lookups/ransomware_extensions.csv

@@ -28,7 +28,6 @@ Extensions,Name
 .bitstak,BitStak
 .Silent,BlackShades Crypter
 .blocatto,Blocatto
-.lock,Brazilian
 .cry,Central Security Treatment Organization
 .cerber,Cerber
 .cerber2,Cerber
@@ -299,4 +298,4 @@ Extensions,Name
 .FUSION,Fusion
 .MILIHPEN,Milihpen
 .GANGBANG,Gangbang
-.reddot,RedDot
+.reddot,RedDot

dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -20,20 +20,18 @@ references:
 risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
   on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
   that warrants investigating.
-search: '| from read_ssa_enriched_events()
-
-  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
-  | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
-  parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
-  null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event,
-  "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
-  "string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null)
-  | where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"),
+  "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"),
+  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string",
+  null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
+  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,"event_id"),
+  "string", null) | where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
   | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe"
   OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
   OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
   OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
-  AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%patch1-Hotfix1a%"))))
+  AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)patch1-Hotfix1a/)=false)))
   OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
   IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,

dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml

@@ -0,0 +1,99 @@
+author: Jose Hernandez, Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-17'
+description: Malicious actors often abuse misconfigured LDAP servers or applications
+  that use the LDAP servers in organizations. Outbound LDAP traffic should not be
+  allowed outbound through your perimeter firewall. This search will help determine
+  if you have any LDAP connections to IP addresses outside of private (RFC1918) address
+  space.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on network traffic, specifically data that populates the Network_Traffic datamodel.
+  To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic
+  events.
+id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449
+known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be
+  allowed outbound through your perimeter firewall. Please check those servers to
+  verify if the activity is legitimate.
+name: TCP Command and Scripting Interpreter Outbound LDAP Traffic
+product:
+- Splunk Behavioral Analytics
+references:
+- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
+- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html
+- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a
+risk_message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting
+  to dest ip $dest_ip$
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"),
+  "collection<string>", [])[0] | where dest_port=389 OR dest_port=1389 OR dest_port=636
+  | where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip,
+  cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port,
+  "dest_ip", dest_ip]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Log4Shell CVE-2021-44228
+  cis20:
+  - CIS 13
+  confidence: 70
+  context:
+  - Scope:Outbound
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
+  impact: 50
+  kill_chain_phases:
+  - Execution
+  message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting
+    to dest ip $dest_ip$
+  mitre_attack_id:
+  - T1059
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: low
+  security_domain: network
+test:
+  name: TCP Command and Scripting Interpreter Outbound LDAP Traffic Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
+      file_name: pantraffic.txt
+      source: pan:traffic
+      sourcetype: pan:traffic
+    description: Test PAN Traffic Logs LDAP outbound connection
+    file: network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml
+    name: PAN Traffic Logs
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 1

dist/ssa/srs/ssa___windows_bits_job_persistence.yml

@@ -0,0 +1,106 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-15'
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
+  The query identifies the parameters used to create, resume or add a file to a BITS
+  job. Typically seen combined in a oneliner or ran in sequence. If identified, review
+  the BITS job created and capture any files written to disk. It is possible for BITS
+  to be used to upload files and this may require further network data analysis to
+  identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 1e25e97a-8ea4-11ec-9767-acde48001122
+known_false_positives: Limited false positives will be present. Typically, applications
+  will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
+  (legitimate applications) or parent process.
+name: Windows Bits Job Persistence
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1197/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
+- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line,
+  "%setnotifyflags%") OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line,
+  "%setminretrydelay%") OR like (cmd_line, "%setcustomheaders%") OR like (cmd_line,
+  "%resume%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - BITS Jobs
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
+  mitre_attack_id:
+  - T1197
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 56
+  risk_severity: medium
+  security_domain: endpoint
+test:
+  name: Windows Bits Job Persistence Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+      file_name: bits-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_bits_job_persistence.yml
+    name: Windows Bits Job Persistence
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml

@@ -0,0 +1,110 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
+  object. In addition, look for `download` or `upload` on the command-line, the switches
+  are not required to perform a transfer. Capture any files downloaded. Review the
+  reputation of the IP or domain used. Typically once executed, a follow on command
+  will be used to execute the dropped file. Note that the network connection or file
+  modification events related will not spawn or create from `bitsadmin.exe`, but the
+  artifacts will appear in a parallel process of `svchost.exe` with a command-line
+  similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel
+  and child processes to capture any behaviors and artifacts. In some suspicious and
+  malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
+  to list out the jobs during investigation.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: d76e8188-8f5a-11ec-ace4-acde48001122
+known_false_positives: Limited false positives, however it may be required to filter
+  based on parent process name or network connection.
+name: Windows Bitsadmin Download File
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
+- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
+- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
+- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
+  "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - BITS Jobs
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: Windows Bitsadmin Download File Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+      file_name: bits-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_bitsadmin_download_file.yml
+    name: Windows Bitsadmin Download File
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_certutil_decode_file.yml

@@ -0,0 +1,106 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
+  and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
+  and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
+  file that was downloaded. Once decoded, it will be loaded by a parallel process.
+  Note that there are two additional command switches that may be used - `encodehex`
+  and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
+  further execution. During triage, identify the source of the file being decoded.
+  Review its contents or execution behavior for further analysis.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: b06983f4-8f72-11ec-ab50-acde48001122
+known_false_positives: Typically seen used to `encode` files, but it is possible to
+  see legitimate use of `decode`. Filter based on parent-child relationship, file
+  paths, endpoint or user.
+name: Windows CertUtil Decode File
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1140/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
+- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file
+  on disk.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%decode%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
+  "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Deobfuscate-Decode Files or Information
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/ master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file
+    on disk.
+  mitre_attack_id:
+  - T1140
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 40
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: Windows CertUtil Decode File Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_certutil_decode_file.yml
+    name: Windows CertUtil Decode File
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml

@@ -0,0 +1,101 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: Certutil.exe may download a file from a remote destination using `-urlcache`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
+  During triage, capture any files on disk and review. Review the reputation of the
+  remote IP or domain in question.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 8cb1ad38-8f6d-11ec-87a3-acde48001122
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+name: Windows CertUtil URLCache Download
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
+  "%urlcache%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows CertUtil URLCache Download Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+      file_name: T1105-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_certutil_urlcache_download.yml
+    name: Windows CertUtil URLCache Download
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml

@@ -0,0 +1,102 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
+  This behavior does require a URL to be passed on the command-line. In addition,
+  `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
+  be used. It is not entirely common for `certutil.exe` to contact public IP space.
+  \ During triage, capture any files on disk and review. Review the reputation of
+  the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
+  written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 9ac29c40-8f6b-11ec-b19a-acde48001122
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+name: Windows CertUtil VerifyCtl Download
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
+  AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
+  "%verifyctl%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - DarkSide Ransomware
+  - Living Off The Land
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Command and Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows CertUtil VerifyCtl Download  Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
+      file_name: T1105-windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_certutil_verifyctl_download_.yml
+    name: Windows CertUtil VerifyCtl Download
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml

@@ -0,0 +1,99 @@
+author: Lou Stella, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-17'
+description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server.
+  It has a scripting mode intended for complex scripted backup operations. This feature
+  also allows for execution of arbitrary unsigned code. This analytic looks for the
+  usage of the scripting mode flags in executions of DiskShadow. During triage, compare
+  to known backup behavior in your environment and then review the scripts called
+  by diskshadow.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on processes that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+id: aa502688-9037-11ec-842d-acde48001122
+known_false_positives: Administrators using the DiskShadow tool in their infrastructure
+  as a main backup tool with scripts will cause false positives
+name: Windows Diskshadow Proxy Execution
+product:
+- Splunk Behavioral Analytics
+references:
+- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event,
+  "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="diskshadow.exe"
+  AND (like (cmd_line, "%-s%") OR like (cmd_line, "%/s%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
+  mitre_attack_id:
+  - T1218
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: BA Windows Diskshadow Proxy Execution Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_diskshadow_proxy_execution.yml
+    name: BA Windows Diskshadow Proxy Execution
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 1

dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml

@@ -0,0 +1,99 @@
+author: Lou Stella, Splunk
+datamodel:
+- Endpoint_Registry
+date: '2022-02-18'
+description: The following search identifies Eventvwr bypass by identifying the registry
+  modification into a specific path that eventvwr.msc looks to (but is not valid)
+  upon execution. A successful attack will include a suspicious command to be executed
+  upon eventvwr.msc loading. Upon triage, review the parallel processes that have
+  executed. Identify any additional registry modifications on the endpoint that may
+  look suspicious. Remediate as necessary.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Registry` datamodel.
+id: 66adff66-90d9-11ec-aba7-acde48001122
+known_false_positives: None known at this time.
+name: Windows Eventvwr UAC Bypass
+product:
+- Splunk Behavioral Analytics
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://attack.mitre.org/techniques/T1548/002
+- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
+risk_message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)),
+  registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)),
+  registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string",
+  null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"),
+  "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"),
+  "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"),
+  "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"),
+  "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive",
+  registry_hive, "registry_value_name", registry_value_name, "registry_key_name",
+  registry_key_name, "registry_value_type", registry_value_type, "registry_value_data",
+  registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - IcedID
+  - Living Off The Land
+  cis20:
+  - CIS 14
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+  impact: 80
+  kill_chain_phases:
+  - Privilege Escalation
+  message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  nist:
+  - DE.AE
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - event_id
+  - registry_path
+  - registry_hive
+  - registry_value_name
+  - registry_key_name
+  - registry_value_type
+  - registry_value_data
+  - process_guid
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows Eventvwr UAC Bypass Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+      file_name: windows-sysmon-registry.log
+      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+      sourcetype: xmlwineventlog
+    file: endpoint/ssa___windows_eventvwr_uac_bypass.yml
+    name: Windows Eventvwr UAC Bypass
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 1

dist/ssa/srs/ssa___windows_mshta_child_process.yml

@@ -0,0 +1,107 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-23'
+description: The following analytic identifies child processes spawning from  "mshta.exe".
+  The search will return the first time and last time these command-line arguments
+  were used for these executions, as well as the target system, the user, parent process
+  "mshta.exe" and its child process.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: f63f7e9c-9526-11ec-9fc7-acde48001122
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+name: Windows MSHTA Child Process
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
+  destination to download an additional payload.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT
+  NULL | where parent_process_name="mshta.exe" AND process_name="powershell.exe" OR
+  process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe"
+  OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe"
+  OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe"  OR process_name="wscript.exe"
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Suspicious MSHTA Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
+    destination to download an additional payload.
+  mitre_attack_id:
+  - T1218.005
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows MSHTA Child Process Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_mshta_child_process.yml
+    name: Windows MSHTA Child Process
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_mshta_command-line_url.yml

@@ -0,0 +1,109 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-23'
+description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
+  utility is used to make remote http connections. Adversaries may use mshta.exe to
+  proxy the download and execution of remote .hta files. The analytic identifies command
+  line arguments of http and https being used. This technique is commonly used by
+  malicious software to bypass preventative controls. The search will return the first
+  time and last time these command-line arguments were used for these executions,
+  as well as the target system, the user, process "rundll32.exe" and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 9b35c538-94ef-11ec-9439-acde48001122
+known_false_positives: It is possible legitimate applications may perform this behavior
+  and will need to be filtered.
+name: Windows MSHTA Command-Line URL
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
+  destination to download an additional payload.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Suspicious MSHTA Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
+    destination to download an additional payload.
+  mitre_attack_id:
+  - T1218.005
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows MSHTA Command-Line URL Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_mshta_command_line_url.yml
+    name: Windows MSHTA Command-Line URL
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml

@@ -0,0 +1,107 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-23'
+description: The following analytic identifies "mshta.exe" execution with inline protocol
+  handlers. "JavaScript", "VBScript", and "About" are the only supported options when
+  invoking HTA content directly on the command-line. The search will return the first
+  time and last time these command-line arguments were used for these executions,
+  as well as the target system, the user, process "mshta.exe" and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 24962154-9524-11ec-9333-acde48001122
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+name: Windows MSHTA Inline HTA Execution
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA, indicative
+  of defense evasion.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe"
+  AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line,
+  "%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Suspicious MSHTA Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA,
+    indicative of defense evasion.
+  mitre_attack_id:
+  - T1218.005
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows MSHTA Inline HTA Execution Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_mshta_inline_hta_execution.yml
+    name: Windows MSHTA Inline HTA Execution
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_powershell_start-bitstransfer.yml

@@ -0,0 +1,103 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-16'
+description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar
+  functionality is present. This technique variation is not as commonly used by adversaries,
+  but has been abused in the past. Lesser known uses include the ability to set the
+  `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload`
+  is used, it is highly possible files will be archived. During triage, review parallel
+  processes and process lineage. Capture any files on disk and review. For the remote
+  domain or IP, what is the reputation?
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+id: 0bafd086-8f61-11ec-996e-acde48001122
+known_false_positives: Limited false positives. It is possible administrators will
+  utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
+  process or command-line arguments.
+name: Windows PowerShell Start-BitsTransfer
+product:
+- Splunk Behavioral Analytics
+references:
+- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
+- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
+  (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - BITS Jobs
+  - Living Off The Land
+  automated_detection_testing: passed
+  cis20: []
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1197
+  - T1105
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 49
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: Windows PowerShell Start-BitsTransfer Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
+      file_name: T1197_windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_powershell_start_bitstransfer.yml
+    name: Windows PowerShell Start-BitsTransfer
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml

@@ -0,0 +1,101 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-15'
+description: The following analytic identifies the Windows Windows Remote Auto Dialer,
+  rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary
+  shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review
+  parent and child process behavior including file and image loads.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 6f42b8ce-1e15-11ec-ad5a-acde48001122
+known_false_positives: False positives will be limited to applications that require
+  Rasautou.exe to load a DLL from disk. Filter as needed.
+name: Windows Rasautou DLL Execution
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/mandiant/DueDLLigence
+- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
+- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513
+- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe"
+  AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Living Off The Land
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+  mitre_attack_id:
+  - T1055.001
+  - T1218
+  - T1055
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Windows Rasautou DLL Execution Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_rasautou_dll_execution.yml
+    name: Windows Rasautou DLL Execution
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml

@@ -0,0 +1,112 @@
+author: Michael Haag, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2022-02-23'
+description: The following analytic identifies "rundll32.exe" execution with inline
+  protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
+  options when invoking HTA content directly on the command-line. This type of behavior
+  is commonly observed with fileless malware or application whitelisting bypass techniques.
+  The search will return the first time and last time these command-line arguments
+  were used for these executions, as well as the target system, the user, process
+  "rundll32.exe" and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 0caa1dd6-94f5-11ec-9786-acde48001122
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+name: Windows Rundll32 Inline HTA Execution
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+risk_message: Suspicious $process_name$ inline HTA execution on $dest_device_id$.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="rundll32.exe"
+  AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line,
+  "%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Suspicious MSHTA Activity
+  - NOBELIUM Group
+  - Living Off The Land
+  asset_type: Endpoint
+  automated_detection_testing: passed
+  cis20:
+  - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Initial Access
+  - Stage:Execution
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Suspicious $process_name$ inline HTA execution on $dest_device_id$.
+  mitre_attack_id:
+  - T1218
+  - T1218.005
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 56
+  risk_severity: medium
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+test:
+  name: Windows Rundll32 Inline HTA Execution Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    file: endpoint/ssa___windows_rundll32_inline_hta_execution.yml
+    name: Windows Rundll32 Inline HTA Execution
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1

docs/_data/navigation.yml

@@ -64,6 +64,8 @@ detections:
         url: /detections/network_sessions/
       - title: Network_Traffic
         url: /detections/network_traffic/
+      - title: Risk
+        url: /detections/risk/
       - title: Updates
         url: /detections/updates/
       - title: Web

docs/_pages/adversary_tactics.md

@@ -11,9 +11,10 @@ sidebar:
 | Name        | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | [Active Directory Discovery](/stories/active_directory_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
+| [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting) | [Credential Access](/tags/#credential-access) |
 | [Active Directory Lateral Movement](/stories/active_directory_lateral_movement/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | [Lateral Movement](/tags/#lateral-movement) |
 | [Active Directory Password Spraying](/stories/active_directory_password_spraying/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access) |
-| [BITS Jobs](/stories/bits_jobs/) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) |
+| [BITS Jobs](/stories/bits_jobs/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Defense Evasion](/tags/#defense-evasion) |
 | [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Cobalt Strike](/stories/cobalt_strike/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [Defense Evasion](/tags/#defense-evasion) |
 | [Collection and Staging](/stories/collection_and_staging/) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
@@ -29,13 +30,15 @@ sidebar:
 | [HAFNIUM Group](/stories/hafnium_group/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Linux Persistence Techniques](/stories/linux_persistence_techniques/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Linux Post-Exploitation](/stories/linux_post-exploitation/) | [Unix Shell](/tags/#unix-shell) | [Execution](/tags/#execution) |
 | [Linux Privilege Escalation](/stories/linux_privilege_escalation/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Living Off The Land](/stories/living_off_the_land/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Malicious PowerShell](/stories/malicious_powershell/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](/stories/meterpreter/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
 | [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
-| [NOBELIUM Group](/stories/nobelium_group/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
+| [NOBELIUM Group](/stories/nobelium_group/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) |
 | [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
 | [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [ProxyShell](/stories/proxyshell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
@@ -53,13 +56,13 @@ sidebar:
 | [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious WMI Use](/stories/suspicious_wmi_use/) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Persistence](/tags/#persistence) |
 | [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) |
 | [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) |
+| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Persistence](/tags/#persistence) |
 | [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |

docs/_pages/detections.md

@@ -28,6 +28,7 @@ sidebar:
 | [AWS IAM Delete Policy](/cloud/aws_iam_delete_policy/) | [Account Manipulation](/tags/#account-manipulation) | Hunting |
 | [AWS IAM Failure Group Deletion](/cloud/aws_iam_failure_group_deletion/) | [Account Manipulation](/tags/#account-manipulation) | Anomaly |
 | [AWS IAM Successful Group Deletion](/cloud/aws_iam_successful_group_deletion/) | [Cloud Groups](/tags/#cloud-groups), [Account Manipulation](/tags/#account-manipulation), [Permission Groups Discovery](/tags/#permission-groups-discovery) | Hunting |
+| [AWS Lambda UpdateFunctionCode](/cloud/aws_lambda_updatefunctioncode/) | [User Execution](/tags/#user-execution) | Hunting |
 | [AWS Network Access Control List Created with All Open Ports](/cloud/aws_network_access_control_list_created_with_all_open_ports/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [AWS Network Access Control List Deleted](/cloud/aws_network_access_control_list_deleted/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | Anomaly |
 | [AWS SAML Access by Provider User and Principal](/cloud/aws_saml_access_by_provider_user_and_principal/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly |
@@ -235,6 +236,8 @@ sidebar:
 | [Disable Windows App Hotkeys](/endpoint/disable_windows_app_hotkeys/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
+| [Disabled Kerberos Pre-Authentication Discovery With Get-ADUser](/endpoint/disabled_kerberos_pre-authentication_discovery_with_get-aduser/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting) | TTP |
+| [Disabled Kerberos Pre-Authentication Discovery With PowerView](/endpoint/disabled_kerberos_pre-authentication_discovery_with_powerview/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting) | TTP |
 | [Disabling CMD Application](/endpoint/disabling_cmd_application/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disabling ControlPanel](/endpoint/disabling_controlpanel/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disabling Defender Services](/endpoint/disabling_defender_services/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
@@ -360,7 +363,6 @@ sidebar:
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
-| [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [High Frequency Copy Of Files In Network Share](/endpoint/high_frequency_copy_of_files_in_network_share/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | Anomaly |
 | [High Number of Login Failures from a single source](/cloud/high_number_of_login_failures_from_a_single_source/) | [Password Guessing](/tags/#password-guessing), [Brute Force](/tags/#brute-force) | Anomaly |
 | [High Process Termination Frequency](/endpoint/high_process_termination_frequency/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly |
@@ -373,7 +375,9 @@ sidebar:
 | [Interactive Session on Remote Endpoint with PowerShell](/endpoint/interactive_session_on_remote_endpoint_with_powershell/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | TTP |
 | [Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
 | [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | TTP |
-| [Kerberoasting spn request with RC4 encryption](/endpoint/kerberoasting_spn_request_with_rc4_encryption/) | [Kerberoasting](/tags/#kerberoasting), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP |
+| [Kerberoasting spn request with RC4 encryption](/endpoint/kerberoasting_spn_request_with_rc4_encryption/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting) | TTP |
+| [Kerberos Pre-Authentication Flag Disabled in UserAccountControl](/endpoint/kerberos_pre-authentication_flag_disabled_in_useraccountcontrol/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting) | TTP |
+| [Kerberos Pre-Authentication Flag Disabled with PowerShell](/endpoint/kerberos_pre-authentication_flag_disabled_with_powershell/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting) | TTP |
 | [Known Services Killed by Ransomware](/endpoint/known_services_killed_by_ransomware/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [Kubernetes AWS detect suspicious kubectl calls]() | None | Hunting |
 | [Kubernetes Nginx Ingress LFI](/cloud/kubernetes_nginx_ingress_lfi/) | [Exploitation for Credential Access](/tags/#exploitation-for-credential-access) | TTP |
@@ -386,6 +390,7 @@ sidebar:
 | [Linux At Application Execution](/endpoint/linux_at_application_execution/) | [At (Linux)](/tags/#at-(linux)), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
 | [Linux Change File Owner To Root](/endpoint/linux_change_file_owner_to_root/) | [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | Anomaly |
 | [Linux Common Process For Elevation Control](/endpoint/linux_common_process_for_elevation_control/) | [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Hunting |
+| [Linux DD File Overwrite](/endpoint/linux_dd_file_overwrite/) | [Data Destruction](/tags/#data-destruction) | TTP |
 | [Linux Doas Conf File Creation](/endpoint/linux_doas_conf_file_creation/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Anomaly |
 | [Linux Doas Tool Execution](/endpoint/linux_doas_tool_execution/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Anomaly |
 | [Linux Edit Cron Table Parameter](/endpoint/linux_edit_cron_table_parameter/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job) | Hunting |
@@ -412,11 +417,13 @@ sidebar:
 | [Linux Setuid Using Setcap Utility](/endpoint/linux_setuid_using_setcap_utility/) | [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Anomaly |
 | [Linux Sudo OR Su Execution](/endpoint/linux_sudo_or_su_execution/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Hunting |
 | [Linux Sudoers Tmp File Creation](/endpoint/linux_sudoers_tmp_file_creation/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Anomaly |
+| [Linux System Network Discovery](/endpoint/linux_system_network_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | Anomaly |
 | [Linux Visudo Utility Execution](/endpoint/linux_visudo_utility_execution/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Anomaly |
 | [Linux pkexec Privilege Escalation](/endpoint/linux_pkexec_privilege_escalation/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP |
 | [Loading Of Dynwrapx Module](/endpoint/loading_of_dynwrapx_module/) | [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection) | TTP |
 | [Local Account Discovery With Wmic](/endpoint/local_account_discovery_with_wmic/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting |
 | [Local Account Discovery with Net](/endpoint/local_account_discovery_with_net/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting |
+| [Log4Shell CVE-2021-44228 Exploitation](/endpoint/log4shell_cve-2021-44228_exploitation/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Correlation |
 | [Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | Anomaly |
 | [Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | Anomaly |
 | [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP |
@@ -433,6 +440,7 @@ sidebar:
 | [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
 | [Malicious Powershell Executed As A Service](/endpoint/malicious_powershell_executed_as_a_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | TTP |
 | [Microsoft Exchange Mailbox Replication service writing Active Server Pages](/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
+| [Mimikatz PassTheTicket CommandLine Parameters](/endpoint/mimikatz_passtheticket_commandline_parameters/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket) | TTP |
 | [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model) | TTP |
 | [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | TTP |
 | [Modify ACL permission To Files Or Folder](/endpoint/modify_acl_permission_to_files_or_folder/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
@@ -574,6 +582,8 @@ sidebar:
 | [Resize Shadowstorage Volume](/endpoint/resize_shadowstorage_volume/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP |
 | [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry) | TTP |
+| [Rubeus Command Line Parameters](/endpoint/rubeus_command_line_parameters/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [AS-REP Roasting](/tags/#as-rep-roasting) | TTP |
+| [Rubeus Kerberos Ticket Exports Through Winlogon Access](/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket) | TTP |
 | [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Runas Execution in CommandLine](/endpoint/runas_execution_in_commandline/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft) | Hunting |
 | [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | Hunting |
@@ -643,6 +653,7 @@ sidebar:
 | [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP |
 | [Suspicious Java Classes]() | None | Anomaly |
 | [Suspicious Kerberos Service Ticket Request](/endpoint/suspicious_kerberos_service_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP |
+| [Suspicious Linux Discovery Commands](/endpoint/suspicious_linux_discovery_commands/) | [Unix Shell](/tags/#unix-shell) | TTP |
 | [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP |
 | [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild) | TTP |
 | [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP |
@@ -675,6 +686,7 @@ sidebar:
 | [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP |
 | [System User Discovery With Query](/endpoint/system_user_discovery_with_query/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting |
 | [System User Discovery With Whoami](/endpoint/system_user_discovery_with_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting |
+| [TCP Command and Scripting Interpreter Outbound LDAP Traffic](/network/tcp_command_and_scripting_interpreter_outbound_ldap_traffic/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly |
 | [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | TTP |
 | [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [Trickbot Named Pipe](/endpoint/trickbot_named_pipe/) | [Process Injection](/tags/#process-injection) | TTP |
@@ -687,6 +699,7 @@ sidebar:
 | [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Unusual LOLBAS in short period of time](/endpoint/unusual_lolbas_in_short_period_of_time/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
 | [Unusual Number of Computer Service Tickets Requested](/endpoint/unusual_number_of_computer_service_tickets_requested/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
+| [Unusual Number of Kerberos Service Tickets Requested](/endpoint/unusual_number_of_kerberos_service_tickets_requested/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting) | Anomaly |
 | [Unusual Number of Remote Endpoint Authentication Events](/endpoint/unusual_number_of_remote_endpoint_authentication_events/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
 | [Unusual Volume of Data Download from Internal Server Per Entity](/network/unusual_volume_of_data_download_from_internal_server_per_entity/) | [Data from Information Repositories](/tags/#data-from-information-repositories), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | Anomaly |
 | [Unusually Long Command Line]() | None | Anomaly |
@@ -718,15 +731,28 @@ sidebar:
 | [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | Hunting |
 | [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
 | [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP |
+| [Windows Bits Job Persistence](/endpoint/windows_bits_job_persistence/) | [BITS Jobs](/tags/#bits-jobs) | TTP |
+| [Windows Bitsadmin Download File](/endpoint/windows_bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
+| [Windows CertUtil Decode File](/endpoint/windows_certutil_decode_file/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | TTP |
+| [Windows CertUtil URLCache Download](/endpoint/windows_certutil_urlcache_download/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
+| [Windows CertUtil VerifyCtl Download](/endpoint/windows_certutil_verifyctl_download/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Curl Download to Suspicious Path](/endpoint/windows_curl_download_to_suspicious_path/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows DISM Remove Defender](/endpoint/windows_dism_remove_defender/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
+| [Windows Disable Memory Crash Dump](/endpoint/windows_disable_memory_crash_dump/) | [Data Destruction](/tags/#data-destruction) | TTP |
 | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Windows DiskCryptor Usage](/endpoint/windows_diskcryptor_usage/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Hunting |
+| [Windows Diskshadow Proxy Execution](/endpoint/windows_diskshadow_proxy_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | Anomaly |
+| [Windows Diskshadow Proxy Execution](/endpoint/windows_diskshadow_proxy_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP |
 | [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | TTP |
+| [Windows Event For Service Disabled](/endpoint/windows_event_for_service_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | Hunting |
 | [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP |
+| [Windows Eventvwr UAC Bypass](/endpoint/windows_eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Anomaly |
+| [Windows Excessive Disabled Services Event](/endpoint/windows_excessive_disabled_services_event/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
+| [Windows File Without Extension In Critical Folder](/endpoint/windows_file_without_extension_in_critical_folder/) | [Data Destruction](/tags/#data-destruction) | TTP |
+| [Windows High File Deletion Frequency](/endpoint/windows_high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [Windows Hunting System Account Targeting Lsass](/endpoint/windows_hunting_system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | Hunting |
 | [Windows InstallUtil Credential Theft](/endpoint/windows_installutil_credential_theft/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP |
 | [Windows InstallUtil Remote Network Connection](/endpoint/windows_installutil_remote_network_connection/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP |
@@ -735,21 +761,34 @@ sidebar:
 | [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP |
 | [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | TTP |
 | [Windows Java Spawning Shells](/endpoint/windows_java_spawning_shells/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
+| [Windows MSHTA Child Process](/endpoint/windows_mshta_child_process/) | [Mshta](/tags/#mshta), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP |
+| [Windows MSHTA Command-Line URL](/endpoint/windows_mshta_command-line_url/) | [Mshta](/tags/#mshta), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP |
+| [Windows MSHTA Inline HTA Execution](/endpoint/windows_mshta_inline_hta_execution/) | [Mshta](/tags/#mshta), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP |
+| [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry) | TTP |
 | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool) | TTP |
 | [Windows NirSoft Utilities](/endpoint/windows_nirsoft_utilities/) | [Tool](/tags/#tool) | Hunting |
 | [Windows Non-System Account Targeting Lsass](/endpoint/windows_non-system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Windows Possible Credential Dumping](/endpoint/windows_possible_credential_dumping/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
+| [Windows PowerShell Start-BitsTransfer](/endpoint/windows_powershell_start-bitstransfer/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Powershell Connect to Internet With Hidden Window](/endpoint/windows_powershell_connect_to_internet_with_hidden_window/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 | [Windows Powershell DownloadFile](/endpoint/windows_powershell_downloadfile/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
+| [Windows Process With NamedPipe CommandLine](/endpoint/windows_process_with_namedpipe_commandline/) | [Process Injection](/tags/#process-injection) | Anomaly |
 | [Windows Raccine Scheduled Task Deletion](/endpoint/windows_raccine_scheduled_task_deletion/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP |
 | [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | TTP |
+| [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | TTP |
+| [Windows Raw Access To Disk Volume Partition](/endpoint/windows_raw_access_to_disk_volume_partition/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | Anomaly |
+| [Windows Raw Access To Master Boot Record Drive](/endpoint/windows_raw_access_to_master_boot_record_drive/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | TTP |
 | [Windows Remote Assistance Spawning Process](/endpoint/windows_remote_assistance_spawning_process/) | [Process Injection](/tags/#process-injection) | TTP |
+| [Windows Rundll32 Inline HTA Execution](/endpoint/windows_rundll32_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP |
 | [Windows Schtasks Create Run As System](/endpoint/windows_schtasks_create_run_as_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Windows Service Created With Suspicious Service Path](/endpoint/windows_service_created_with_suspicious_service_path/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | TTP |
 | [Windows Service Created Within Public Path](/endpoint/windows_service_created_within_public_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
+| [Windows Service Creation Using Registry Entry](/endpoint/windows_service_creation_using_registry_entry/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | TTP |
 | [Windows Service Creation on Remote Endpoint](/endpoint/windows_service_creation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Windows Service Initiation on Remote Endpoint](/endpoint/windows_service_initiation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
+| [Windows WMI Process Call Create](/endpoint/windows_wmi_process_call_create/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | Hunting |
+| [Windows WSReset UAC Bypass](/endpoint/windows_wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Anomaly |
 | [Winhlp32 Spawning a Process](/endpoint/winhlp32_spawning_a_process/) | [Process Injection](/tags/#process-injection) | TTP |
 | [Winword Spawning Cmd](/endpoint/winword_spawning_cmd/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP |
 | [Winword Spawning PowerShell](/endpoint/winword_spawning_powershell/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP |

docs/_pages/malware.md

@@ -15,11 +15,14 @@ sidebar:
 | [ColdRoot MacOS RAT]() | None | None |
 | [DHS Report TA18-074A](/stories/dhs_report_ta18-074a/) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
 | [DarkSide Ransomware](/stories/darkside_ransomware/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
+| [Data Destruction](/stories/data_destruction/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Impact](/tags/#impact) |
 | [Dynamic DNS](/stories/dynamic_dns/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) |
 | [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | [Initial Access](/tags/#initial-access) |
 | [FIN7](/stories/fin7/) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
+| [Hermetic Wiper](/stories/hermetic_wiper/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Impact](/tags/#impact) |
 | [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) |
-| [IcedID](/stories/icedid/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [IcedID](/stories/icedid/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Network Discovery](/stories/network_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | [Discovery](/tags/#discovery) |
 | [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
 | [Ransomware](/stories/ransomware/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) |
 | [Ransomware Cloud](/stories/ransomware_cloud/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |

docs/_pages/risk.md

@@ -0,0 +1,9 @@
+---
+title: Risk
+layout: tag
+author_profile: false
+taxonomy: Risk
+permalink: /detections/risk/
+sidebar:
+  nav: "detections"
+---

docs/_pages/stories.md

@@ -16,11 +16,12 @@ sidebar:
 | [AWS Security Hub Alerts]() | None | None |
 | [AWS User Monitoring](aws_user_monitoring) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [Active Directory Discovery](active_directory_discovery) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
+| [Active Directory Kerberos Attacks](active_directory_kerberos_attacks) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting) | [Credential Access](/tags/#credential-access) |
 | [Active Directory Lateral Movement](active_directory_lateral_movement) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | [Lateral Movement](/tags/#lateral-movement) |
 | [Active Directory Password Spraying](active_directory_password_spraying) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access) |
 | [Apache Struts Vulnerability](apache_struts_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Asset Tracking]() | None | None |
-| [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) |
+| [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Defense Evasion](/tags/#defense-evasion) |
 | [Baron Samedit CVE-2021-3156](baron_samedit_cve-2021-3156) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [BlackMatter Ransomware](blackmatter_ransomware) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
 | [Brand Monitoring]() | None | None |
@@ -37,6 +38,7 @@ sidebar:
 | [DNS Amplification Attacks](dns_amplification_attacks) | [Network Denial of Service](/tags/#network-denial-of-service), [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) |
 | [DNS Hijacking](dns_hijacking) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) |
 | [DarkSide Ransomware](darkside_ransomware) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
+| [Data Destruction](data_destruction) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Impact](/tags/#impact) |
 | [Data Exfiltration](data_exfiltration) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) |
 | [Data Protection](data_protection) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) |
 | [Deobfuscate-Decode Files or Information](deobfuscate-decode_files_or_information) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) |
@@ -50,23 +52,27 @@ sidebar:
 | [FIN7](fin7) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
 | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
 | [HAFNIUM Group](hafnium_group) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
+| [Hermetic Wiper](hermetic_wiper) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Impact](/tags/#impact) |
 | [Hidden Cobra Malware](hidden_cobra_malware) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) |
-| [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [IcedID](icedid) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Information Sabotage](information_sabotage) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [Impact](/tags/#impact) |
 | [Ingress Tool Transfer](ingress_tool_transfer) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Sensitive Object Access Activity]() | None | None |
 | [Linux Persistence Techniques](linux_persistence_techniques) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Linux Post-Exploitation](linux_post-exploitation) | [Unix Shell](/tags/#unix-shell) | [Execution](/tags/#execution) |
 | [Linux Privilege Escalation](linux_privilege_escalation) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Living Off The Land](living_off_the_land) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Malicious PowerShell](malicious_powershell) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](meterpreter) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
 | [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
 | [Monitor for Updates]() | None | None |
-| [NOBELIUM Group](nobelium_group) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
+| [NOBELIUM Group](nobelium_group) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) |
 | [Netsh Abuse](netsh_abuse) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) |
+| [Network Discovery](network_discovery) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | [Discovery](/tags/#discovery) |
 | [Office 365 Detections](office_365_detections) | [Email Forwarding Rule](/tags/#email-forwarding-rule), [Email Collection](/tags/#email-collection) | [Collection](/tags/#collection) |
 | [Orangeworm Attack Group](orangeworm_attack_group) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
 | [PetitPotam NTLM Relay on Active Directory Certificate Services](petitpotam_ntlm_relay_on_active_directory_certificate_services) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
@@ -103,7 +109,7 @@ sidebar:
 | [Suspicious Regsvr32 Activity](suspicious_regsvr32_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious WMI Use](suspicious_wmi_use) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Persistence](/tags/#persistence) |
 | [Suspicious Zoom Child Processes](suspicious_zoom_child_processes) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Trickbot](trickbot) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Execution](/tags/#execution) |
 | [Trusted Developer Utilities Proxy Execution](trusted_developer_utilities_proxy_execution) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) |
@@ -112,11 +118,11 @@ sidebar:
 | [Use of Cleartext Protocols]() | None | None |
 | [WhisperGate](whispergate) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Windows Discovery Techniques](windows_discovery_techniques) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Log Manipulation](windows_log_manipulation) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) |
+| [Windows Persistence Techniques](windows_persistence_techniques) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Persistence](/tags/#persistence) |
 | [Windows Privilege Escalation](windows_privilege_escalation) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
 | [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
 | [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |

docs/_playbooks/delete_detected_files.md

@@ -296,6 +296,9 @@ This playbook acts upon events where a file has been determined to be malicious
 
 
 
+
+
+
 
 
 
@@ -762,6 +765,42 @@ This playbook acts upon events where a file has been determined to be malicious
 
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+