From f0157408a70c9ce340aac598cfa679acf586daec Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 1 Dec 2021 12:28:38 -0700
Subject: [PATCH] Updated some words

---
 .../ssa___attempt_to_delete_services.yml      | 43 ++++++++++-------
 .../ssa___attempt_to_disable_services.yml     | 46 ++++++++++++-------
 .../endpoint/ssa___delete_a_net_user.yml      | 27 ++++++++---
 .../ssa___disable_net_user_account.yml        | 34 +++++++++-----
 .../ssa___resize_shadowstorage_volume.yml     | 31 +++++++++----
 5 files changed, 120 insertions(+), 61 deletions(-)

diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml
index 479e5ffd60..200ddff399 100644
--- a/detections/endpoint/ssa___attempt_to_delete_services.yml
+++ b/detections/endpoint/ssa___attempt_to_delete_services.yml
@@ -1,15 +1,13 @@
 name: Attempt To Delete Services
 id: a0c8c292-d01a-11eb-aa18-acde48001122
-version: 2
-date: '2021-06-18'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, splunk
 type: TTP
 datamodel:
-- Endpoint
-description: This analytic identifies suspicious series of attempt to kill multiple
-  services on a system using either `net.exe` or `sc.exe`. This technique is use by
-  adversaries to terminate security services or other related services to continue
-  there objective and evade detections.
+- Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -26,7 +24,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: unknown
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -55,19 +53,32 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: high
   security_domain: endpoint
-  impact: 70
-  confidence: 70
+  impact: 60
+  confidence: 60
   # (impact * confidence)/100
-  risk_score: 49
+  risk_score: 36
   context:
   - Source:Endpoint
-  - stage:Defense Evasion
-  message: deleted service with commandline $process$ on $dest$ by $user$
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
   observable:
-  - name: dest
-    type: Endpoint
+  - name: dest_user_id
+    type: User
     role:
     - Victim
-    
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml
index 72bb3a7284..f4842b77c4 100644
--- a/detections/endpoint/ssa___attempt_to_disable_services.yml
+++ b/detections/endpoint/ssa___attempt_to_disable_services.yml
@@ -1,15 +1,13 @@
 name: Attempt To Disable Services
 id: afb31de4-d023-11eb-98d5-acde48001122
-version: 2
-date: '2021-06-18'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
-description: This analytic will identify suspicious series of command-line to disable
-  several services. This technique is seen where the adversary attempts to disable
-  security app services or other malware services to complete the objective on the
-  compromised system.
+- Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
   "_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
@@ -27,10 +25,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: unknown
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service 
 tags:
   analytic_story:
   - XMRig
@@ -59,16 +58,29 @@ tags:
   - process
   risk_severity: medium
   security_domain: endpoint
-  impact: 70
-  confidence: 70
+  impact: 60
+  confidence: 60
   # (impact * confidence)/100
-  risk_score: 49
+  risk_score: 36
   context:
   - Source:Endpoint
-  - stage:Defense Evasion
-  message: disable service using sc.exe with commandline $process$ on $dest$ by $user$
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service.
   observable:
-  - name: dest
-    type: Endpoint
+  - name: dest_user_id
+    type: User
     role:
     - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml
index e119134115..25f7681c21 100644
--- a/detections/endpoint/ssa___delete_a_net_user.yml
+++ b/detections/endpoint/ssa___delete_a_net_user.yml
@@ -1,11 +1,11 @@
 name: Delete A Net User
 id: 8776d79c-d26e-11eb-9a56-acde48001122
-version: 2
-date: '2021-06-21'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some
@@ -59,6 +59,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: high
   security_domain: endpoint
   impact: 70
@@ -68,9 +69,21 @@ tags:
   context:
   - Source:Endpoint
   - stage:Defense Evasion
-  message: deleted net users with commandline $process$ on $dest$ by $user$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user account.
   observable:
-  - name: dest
-    type: Endpoint
+  - name: dest_user_id
+    type: User
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml
index 59220e00f6..68fb87b6c1 100644
--- a/detections/endpoint/ssa___disable_net_user_account.yml
+++ b/detections/endpoint/ssa___disable_net_user_account.yml
@@ -1,15 +1,14 @@
 name: Disable Net User Account
 id: ba858b08-d26c-11eb-af9b-acde48001122
-version: 2
-date: '2021-06-21'
+version: 3
+date: '2021-12-01'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: This analytic will identify a suspicious command-line that disables a
-  user account using the `net.exe` utility native to Windows. This technique may used
-  by the adversaries to interrupt availability of such users to do their malicious
-  act.
+  user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used
+  by the adversaries to interrupt availability of accounts and continue the impact against the organization.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -27,8 +26,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
   used.
-known_false_positives: network operator may use this approach to quickly disable an
-  account but not a common practice.
+known_false_positives: System administrators or automated scripts may disable an
+  account but not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -57,6 +56,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: medium
   security_domain: endpoint
   impact: 70
@@ -66,9 +66,21 @@ tags:
   context:
   - Source:Endpoint
   - stage:Defense Evasion
-  message: disable net users with commandline $process$ on $dest$ by $user$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
   observable:
-  - name: dest
-    type: Endpoint
+  - name: user
+    type: User
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
index 2765fa9ace..6a960b11be 100644
--- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml
+++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
@@ -6,12 +6,8 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytics identifies the resizing of shadowstorage by ransomware
-  malware to avoid the shadow volumes being made again. this technique is an alternative
-  by ransomware attacker than deleting the shadowstorage which is known alert in defensive
-  team. one example of ransomware that use this technique is CLOP ransomware where
-  it drops a .bat file that will resize the shadowstorage to minimum size as much
-  as possible
+description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event 
+  and a precursor to deleting the shadowstorage. 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -29,7 +25,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: network admin can resize the shadowstorage for valid purposes.
+known_false_positives: System administrators may resize the shadowstorage for valid purposes. Filter as needed.
 references:
 - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
@@ -59,6 +55,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: high
   security_domain: endpoint
   impact: 80
@@ -68,9 +65,23 @@ tags:
   context:
   - Source:Endpoint
   - stage:Defense Evasion
-  message: resize shadow copy made by process $process_name$ with commandline $process$ on $dest$ by $user$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow copy to perform
+    offline password cracking.
   observable:
-  - name: dest
-    type: Endpoint
+  - name: dest_user_id
+    type: User
     role:
     - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process