From fb287ba8a4cffae1e52ba877c5adea8f7fb8cec1 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 16 Jun 2021 12:55:23 +0200
Subject: [PATCH] Delete recon_avproduct_through_pwh_or_wmi.yml

---
 .../recon_avproduct_through_pwh_or_wmi.yml    | 43 -------------------
 1 file changed, 43 deletions(-)
 delete mode 100644 detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml

diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
deleted file mode 100644
index 843a8a7465..0000000000
--- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: Recon AVProduct Through Pwh or WMI
-id: 28077620-c9f6-11eb-8785-acde48001122
-version: 1
-date: '2021-06-10'
-author: Teoderick Contreras, Splunk
-type: batch
-datamodel:
-- Endpoint
-description: This search is to detect a powershell script that do a recon or checking
-  to the av product install on the machine. This technique is commonly seen in APT
-  or malware like ransomware to list all security product and disable it.
-search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*"
-  OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time)
-  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs from your endpoints. make sure you enable needed registry
-  to monitor this event.
-known_false_positives: network administrator may used this command for checking purposes
-references:
-- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
-tags:
-  analytic_story:
-  - Ransomware
-  - Malicious PowerShell
-  kill_chain_phases:
-  - Reconnaissance
-  mitre_attack_id:
-  - T1592
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventCode
-  - Message
-  - ComputerName
-  - User
-  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log