testing and update of story Windows Service Abuse

baselines/previously_seen_running_windows_services.yml

@@ -1,17 +1,16 @@
 name: Previously Seen Running Windows Services
 id: 64ce0ade-cb01-4678-bddd-d31c0b175394
-version: 2
-date: '2020-01-13'
+version: 3
+date: '2020-06-15'
 description: This collects the services that have been started across your entire
   enterprise.
 how_to_implement: While this search does not require you to adhere to Splunk CIM,
   you must be ingesting your Windows security-event logs for it to execute successfully.
   Please ensure that the Splunk Add-on for Microsoft Windows is version 5.0.0 or above.
 author: David Dorsey, Splunk
-search: '`wineventlog_system` signature_id=7036 | rename param1 as service_name |
+search: '`wineventlog_system` EventCode=7036 | rename param1 as service_name |
   rename param2 as action | search action="running" | stats earliest(_time) as firstTime,
-  latest(_time) as lastTime by service_name | outputlookup previously_seen_running_windows_services
-  | stats count'
+  latest(_time) as lastTime by service_name | outputlookup previously_seen_running_windows_services'
 tags:
   analytics_story:
   - Orangeworm Attack Group

detections/first_time_seen_running_windows_service.yml

@@ -1,7 +1,7 @@
 name: First Time Seen Running Windows Service
 id: 823136f2-d755-4b6d-ae04-372b486a5808
-version: 2
-date: '2020-01-13'
+version: 3
+date: '2020-06-15'
 description: This search looks for the first time a Windows service is seen running
   in your environment.
 how_to_implement: While this search does not require you to adhere to Splunk CIM,
@@ -12,9 +12,9 @@ how_to_implement: While this search does not require you to adhere to Splunk CIM
 type: ESCU
 references: []
 author: David Dorsey, Splunk
-search: '`wineventlog_system` signature_id=7036 | rename param1 as service_name |
+search: '`wineventlog_system` EventCode=7036 | rename param1 as service_name |
   rename param2 as action | search action="running" [ search `wineventlog_system`
-  signature_id=7036 | rename param1 as service_name | rename param2 as action | search
+  EventCode=7036 | rename param1 as service_name | rename param2 as action | search
   action="running" | stats earliest(_time) as firstTime, latest(_time) as lastTime
   by service_name | inputlookup append=t previously_seen_running_windows_services
   | stats min(firstTime) as firstTime max(lastTime) as lastTime by service_name |

detections/reg_exe_manipulating_windows_services_registry_keys.yml

@@ -1,25 +1,18 @@
 name: Reg exe Manipulating Windows Services Registry Keys
 id: 8470d755-0c13-45b3-bd63-387a373c10cf
-version: 2
-date: '2019-03-01'
+version: 3
+date: '2020-06-15'
 description: The search looks for reg.exe modifying registry keys that define Windows
   services and their configurations.
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on registry changes that include the name of the process responsible for the changes
-  from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry`
-  nodes.
 type: ESCU
 references: []
 author: Rico Valdez, Splunk
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name)
-  as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes
-  where Processes.process_name = reg.exe by Processes.process_id Processes.dest |
-  `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | join [| tstats `security_content_summariesonly` values(Registry.registry_path)
-  as registry_path count  FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\services\\*"
-  by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table
-  process_id dest registry_path] | `reg_exe_manipulating_windows_services_registry_keys_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name
+  values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes
+  where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* Processes.process=*Services*
+  by Processes.process_id Processes.dest Processes.process | `drop_dm_object_name("Processes")`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `reg_exe_manipulating_windows_services_registry_keys_filter`'
 known_false_positives: It is unusual for a service to be created or modified by directly
   manipulating the registry. However, there may be legitimate instances of this behavior.
   It is important to validate and investigate, as appropriate.
@@ -28,9 +21,7 @@ tags:
   - Windows Service Abuse
   - Windows Persistence Techniques
   mitre_attack_id:
-  - T1050
-  - T1031
-  - T1089
+  - T1058
   kill_chain_phases:
   - Installation
   cis20:

detections/sc_exe_manipulating_windows_services.yml

@@ -1,14 +1,9 @@
 name: Sc exe Manipulating Windows Services
 id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d
-version: 2
-date: '2019-02-27'
+version: 3
+date: '2020-06-15'
 description: This search looks for arguments to sc.exe indicating the creation or
   modification of a Windows service.
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
 type: ESCU
 references: []
 author: Rico Valdez, Splunk
@@ -30,8 +25,6 @@ tags:
   - Disabling Security Tools
   mitre_attack_id:
   - T1050
-  - T1031
-  - T1089
   kill_chain_phases:
   - Installation
   cis20: