cleaning up a mistakenly added file

detections/endpoint/ssa___windows_powersh.yml

@@ -1,94 +0,0 @@
-name: Windows Powershell DownloadFile
-id: 46440222-81d5-44b1-a376-19dcd70d1b08
-version: 1
-date: '2022-02-11'
-author: Jose Hernandez, Michael Haag, Splunk
-type: Anomaly
-datamodel:
-- Endpoint_Processes
-description: The following analytic identifies the use of PowerShell downloading a
-  file using `DownloadFile` method. This particular method is utilized in many different
-  PowerShell frameworks to download files and output to disk. Identify the source
-  (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
-  transaction logs are available, review for further details of the implant.
-search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
-  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
-  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
-  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
-  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
-  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
-  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
-  (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
-  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
-  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
-  | into write_ssa_detected_events();'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be present and filtering will need to occur
-  by parent process or command line argument. It may be required to modify this query
-  to an EDR product for more granular coverage.
-references:
-- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0
-- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
-tags:
-  analytic_story:
-  - Malicious PowerShell
-  - Ingress Tool Transfer
-  - Log4Shell CVE-2021-44228
-  cis20:
-  - CIS 8
-  confidence: 70
-  context:
-  - Source:Endpoint
-  - Stage:LateralMovement
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log
-  impact: 50
-  kill_chain_phases:
-  - Lateral Movement
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile
-    within PowerShell.
-  mitre_attack_id:
-  - T1020
-  nist:
-  - PR.PT
-  - DE.CM
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Parent Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - cmd_line
-  risk_score: 35
-  risk_severity: low
-  security_domain: endpoint