From f7bb6e308d83ca4983f8c47bc00d405bb6f015f8 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 20:32:46 -0600
Subject: [PATCH] Added detection testing service results inDetect HTML Help
 Renamed

---
 .../endpoint/detect_html_help_renamed.yml     | 26 ++++++++++---------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index 9864d74ac2..4e4b474520 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -5,7 +5,7 @@ date: '2021-02-11'
 author: Michael Haag, Splunk
 type: batch
 datamodel:
-  - Endpoint
+- Endpoint
 description: The following analytic identifies a renamed instance of hh.exe (HTML
   Help) executing a Compiled HTML Help (CHM). This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any
@@ -21,12 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=HH.exe
   AND Processes.process_name!=hh.exe) by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.original_file_name 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `detect_html_help_renamed_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Although unlikely a renamed instance of hh.exe will be used
   legitimately, filter as needed.
 references:
@@ -49,7 +50,8 @@ tags:
   impact: 80
   kill_chain_phases:
   - Actions on Objectives
-  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$.
+  message: The following $process_name$ has been identified as renamed, spawning from
+    $parent_process_name$.
   mitre_attack_id:
   - T1218.001
   nist:
@@ -80,11 +82,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path