Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm

detections/endpoint/bits_job_persistence.yml

@@ -14,13 +14,17 @@ description: The following query identifies Microsoft Background Intelligent Tra
   to be used to upload files and this may require further network data analysis to
   identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin`
-  Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*,
-  *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process
+  IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*,
+  *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.original_file_name
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives will be present. Typically, applications
   will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
   (legitimate applications) or parent process.
@@ -71,11 +75,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

detections/endpoint/bitsadmin_download_file.yml

@@ -19,12 +19,16 @@ description: The following query identifies Microsoft Background Intelligent Tra
   malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
   to list out the jobs during investigation.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin`
-  Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process=*transfer*
+  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `bitsadmin_download_file_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives, however it may be required to filter
   based on parent process name or network connection.
 references:
@@ -77,11 +81,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

detections/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -10,9 +10,10 @@ description: This search looks for the creation of local administrator accounts
   net.exe .
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  |`create_local_admin_accounts_using_net_exe_filter` '
+  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND
+  (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add*
+  by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`create_local_admin_accounts_using_net_exe_filter` '
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.

detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml

@@ -1,7 +1,7 @@
 name: Creation of Shadow Copy with wmic and powershell
 id: 2ed8b538-d284-449a-be1d-82ad1dbd186b
-version: 2
-date: '2019-12-10'
+version: 3
+date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:

detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml

@@ -1,7 +1,7 @@
 name: Credential Dumping via Copy Command from Shadow Copy
 id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b
 version: 2
-date: '2019-12-10'
+date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:

detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml

@@ -1,22 +1,19 @@
 name: Credential Dumping via Symlink to Shadow Copy
 id: c5eac648-fae0-4263-91a6-773df1f4c903
-version: 1
-date: '2019-12-10'
+version: 2
+date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: This search detects the creation of a symlink to a shadow copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd`
   Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest
-  Processes.user Processes.process_name Processes.process  Processes.parent_process
+  Processes.user Processes.process_name Processes.process  Processes.parent_process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter` '
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: unknown
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf