Branch was auto-updated.

detections/endpoint/batch_file_write_to_system32.yml

@@ -1,7 +1,7 @@
 name: Batch File Write to System32
 id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
-version: 3
-date: '2022-12-21'
+version: 4
+date: '2023-4-11'
 author: Steven Dick, Michael Haag, Rico Valdez, Splunk
 status: production
 type: TTP
@@ -9,16 +9,17 @@ description: The search looks for a batch file (.bat) written to the Windows sys
   directory tree.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=*  by _time span=1h Processes.process_id Processes.process_name
-  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
-  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\system32\\*",
-  "*\\syswow64\\*") Filesystem.file_name="*.bat" by _time span=1h Filesystem.dest
-  Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)`
-  | fields _time dest file_create_time file_name file_path process_name process_path
-  process] | dedup file_create_time | table dest, file_create_time, file_name, file_path,
-  process_name  | `batch_file_write_to_system32_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where 
+Processes.process_name=* by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.user 
+| `drop_dm_object_name(Processes)` | join process_guid 
+    [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
+    where Filesystem.file_path IN ("*\\system32\\*", "*\\syswow64\\*") Filesystem.file_name="*.bat" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid 
+    | `drop_dm_object_name(Filesystem)`]
+| table dest user file_create_time, file_name, file_path, process_name, firstTime, lastTime 
+| dedup file_create_time
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `batch_file_write_to_system32_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -63,6 +64,7 @@ tags:
   required_fields:
   - _time
   - Filesystem.dest
+  - Filesystem.file_create_time
   - Filesystem.file_name
   - Filesystem.user
   - Filesystem.file_path
@@ -71,6 +73,7 @@ tags:
   - Filesystem.process_guid
   - Processes.process_guid
   - Processes.dest
+  - Processes.process_name
   risk_score: 63
   security_domain: endpoint
 tests:

detections/endpoint/powershell_disable_security_monitoring.yml

@@ -5,9 +5,9 @@ date: '2022-07-15'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: This search is to identifies a modification in registry to disable the
-  windows denfender real time behavior monitoring. This event or technique is commonly
-  seen in RAT, bot, or Trojan to disable AV to evade detections.
+description: This search identifies a modification in registry to disable the
+  windows defender real time behavior monitoring. This event or technique is commonly
+  seen in RATs, bots, or Trojans to disable AV to evade detections.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -34,12 +34,12 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: ''
+  message: Windows Defender Real-time Behavior Monitoring disabled on $dest$ 
   mitre_attack_id:
   - T1562.001
   - T1562
   observable:
-  - name: ComputerName
+  - name: dest
     type: Hostname
     role:
     - Victim

detections/endpoint/powershell_enable_smb1protocol_feature.yml

@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 status: production
 type: TTP
 description: This search is to detect a suspicious enabling of smb1protocol through
-  "powershell.exe". This technique was seen in some ransomware (like reddot) where
+  `powershell.exe`. This technique was seen in some ransomware (like reddot) where
   it enable smb share to do the lateral movement and encrypt other files within the
   compromise network system.
 data_source:
@@ -31,13 +31,13 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: Powershell Enable SMB1Protocol Feature
+  message: Powershell Enable SMB1Protocol Feature on $Computer$
   mitre_attack_id:
   - T1027
   - T1027.005
   observable:
-  - name: User
-    type: User
+  - name: Computer
+    type: Hostname
     role:
     - Victim
   product:

detections/endpoint/powershell_execute_com_object.yml

@@ -44,10 +44,6 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: User
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml

@@ -56,10 +56,6 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: User
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml

@@ -32,12 +32,12 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: Recursive Delete of Directory In Batch CMD
+  message: Recursive Delete of Directory In Batch CMD by $user$ on $dest$
   mitre_attack_id:
   - T1070.004
   - T1070
   observable:
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml

@@ -30,13 +30,13 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 90
-  message: A process was started on a remote endpoint from $ComputerName by abusing
+  message: A process was started on a remote endpoint from $Computer$ by abusing
     WMI using PowerShell.exe
   mitre_attack_id:
   - T1021
   - T1021.003
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -47,9 +47,9 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - user_id
   risk_score: 63
   security_domain: endpoint
 tests:

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml

@@ -31,12 +31,12 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 90
-  message: A process was started on a remote endpoint from $ComputerName by abusing
+  message: A process was started on a remote endpoint from $Computer$ by abusing
     WMI using PowerShell.exe
   mitre_attack_id:
   - T1047
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -48,8 +48,8 @@ tags:
   - _time
   - EventCode
   - Message
-  - ComputerName
-  - User
+  - Computer
+  - UserID
   risk_score: 63
   security_domain: endpoint
 tests:
@@ -57,4 +57,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: XmlWinEventLog

detections/endpoint/rundll32_process_creating_exe_dll_files.yml

@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 status: production
 type: TTP
 description: This search is to detect a suspicious rundll32 process that drops executable
-  (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries
+  (.exe or .dll) files. This behavior seen in rundll32 process of IcedID that tries
   to drop copy of itself in temp folder or download executable drop it either appdata
   or programdata as part of its execution.
 data_source:
@@ -34,7 +34,7 @@ tags:
   - T1218
   - T1218.011
   observable:
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim

detections/network/remote_desktop_network_bruteforce.yml

@@ -27,7 +27,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: tbd
+  message: $dest$ may be the target of an RDP Bruteforce
   mitre_attack_id:
   - T1021.001
   - T1021