From 794adbe6f3fb7cab1774aed89db456d6998424e9 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 18 Oct 2021 16:56:46 +0200
Subject: [PATCH 01/14] iceid_ttps

---
 ...able_defender_blockatfirstseen_feature.yml | 65 +++++++++++++++++++
 ...disable_defender_enhanced_notification.yml | 65 +++++++++++++++++++
 .../disable_defender_spynet_reporting.yml     | 64 ++++++++++++++++++
 ...efender_submit_samples_consent_feature.yml | 65 +++++++++++++++++++
 detections/endpoint/disable_schedule_task.yml | 60 +++++++++++++++++
 ...defender_blockatfirstseen_feature.test.yml | 12 ++++
 ...le_defender_enhanced_notification.test.yml | 12 ++++
 ...disable_defender_spynet_reporting.test.yml | 12 ++++
 ...er_submit_samples_consent_feature.test.yml | 12 ++++
 tests/endpoint/disable_schedule_task.test.yml | 12 ++++
 10 files changed, 379 insertions(+)
 create mode 100644 detections/endpoint/disable_defender_blockatfirstseen_feature.yml
 create mode 100644 detections/endpoint/disable_defender_enhanced_notification.yml
 create mode 100644 detections/endpoint/disable_defender_spynet_reporting.yml
 create mode 100644 detections/endpoint/disable_defender_submit_samples_consent_feature.yml
 create mode 100644 detections/endpoint/disable_schedule_task.yml
 create mode 100644 tests/endpoint/disable_defender_blockatfirstseen_feature.test.yml
 create mode 100644 tests/endpoint/disable_defender_enhanced_notification.test.yml
 create mode 100644 tests/endpoint/disable_defender_spynet_reporting.test.yml
 create mode 100644 tests/endpoint/disable_defender_submit_samples_consent_feature.test.yml
 create mode 100644 tests/endpoint/disable_schedule_task.test.yml

diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
new file mode 100644
index 0000000000..5972b9a024
--- /dev/null
+++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
@@ -0,0 +1,65 @@
+name: Disable Defender BlockAtFirstSeen Feature
+id: 2dd719ac-3021-11ec-97b4-acde48001122
+version: 1
+date: '2021-10-18'
+author: Teoderick Contreras
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. 
+  This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it 
+  block suspicious file first seen in the host.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" 
+  Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)`
+  | `disable_defender_blockatfirstseen_feature_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: admin or user may choose to disable windows defender product
+references:
+-  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IceID
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml
new file mode 100644
index 0000000000..fd1149d3c4
--- /dev/null
+++ b/detections/endpoint/disable_defender_enhanced_notification.yml
@@ -0,0 +1,65 @@
+name: Disable Defender Enhanced Notification
+id: dc65678c-301f-11ec-8e30-acde48001122
+version: 1
+date: '2021-10-18'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. 
+  This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user 
+  or admin set to show or display alerts.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" 
+  Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)` 
+  | `disable_defender_enhanced_notification_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: user may choose to disable windows defender AV
+references:
+-  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IceID
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml
new file mode 100644
index 0000000000..66a81374e6
--- /dev/null
+++ b/detections/endpoint/disable_defender_spynet_reporting.yml
@@ -0,0 +1,64 @@
+name: Disable Defender Spynet Reporting
+id: 898debf4-3021-11ec-ba7c-acde48001122
+version: 1
+date: '2021-10-18'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. 
+  This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" 
+  Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)` 
+  | `disable_defender_spynet_reporting_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: admin or user may choose to disable windows defender product
+references:
+-  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IceID
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
new file mode 100644
index 0000000000..3c6ea56011
--- /dev/null
+++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
@@ -0,0 +1,65 @@
+name: Disable Defender Submit Samples Consent Feature
+id: 73922ff8-3022-11ec-bf5e-acde48001122
+version: 1
+date: '2021-10-18'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: his analytic is to detect a suspicious modification of registry to disable windows defender feature. 
+  This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" 
+  Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)` 
+  | `disable_defender_submit_samples_consent_feature_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: admin or user may choose to disable windows defender product
+references:
+-  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IceID
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml
new file mode 100644
index 0000000000..eea1f120c4
--- /dev/null
+++ b/detections/endpoint/disable_schedule_task.yml
@@ -0,0 +1,60 @@
+name: Disable Schedule Task
+id: db596056-3019-11ec-a9ff-acde48001122
+version: 1
+date: '2021-10-18'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious commandline to disable existing schedule task. 
+  This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) 
+  in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this 
+  detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name=schtasks.exe Processes.process=*/change*  Processes.process=*/disable*
+  by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `disable_schedule_task_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: admin may disable problematic schedule task
+references:
+-  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IcedID
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_schtask/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user 
+  - Processes.process_name
+  - Processes.parent_process_name 
+  - Processes.dest
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: schtask process with commandline $process$ to disable schedule task in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/disable_defender_blockatfirstseen_feature.test.yml b/tests/endpoint/disable_defender_blockatfirstseen_feature.test.yml
new file mode 100644
index 0000000000..c59a71686e
--- /dev/null
+++ b/tests/endpoint/disable_defender_blockatfirstseen_feature.test.yml
@@ -0,0 +1,12 @@
+name: Disable Defender BlockAtFirstSeen Feature Unit Test
+tests:
+- name: Disable Defender BlockAtFirstSeen Feature
+  file: endpoint/disable_defender_blockatfirstseen_feature.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disable_defender_enhanced_notification.test.yml b/tests/endpoint/disable_defender_enhanced_notification.test.yml
new file mode 100644
index 0000000000..04986935f3
--- /dev/null
+++ b/tests/endpoint/disable_defender_enhanced_notification.test.yml
@@ -0,0 +1,12 @@
+name: Disable Defender Enhanced Notification Unit Test
+tests:
+- name: Disable Defender Enhanced Notification
+  file: endpoint/disable_defender_enhanced_notification.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disable_defender_spynet_reporting.test.yml b/tests/endpoint/disable_defender_spynet_reporting.test.yml
new file mode 100644
index 0000000000..2c4152f134
--- /dev/null
+++ b/tests/endpoint/disable_defender_spynet_reporting.test.yml
@@ -0,0 +1,12 @@
+name: Disable Defender Spynet Reporting Unit Test
+tests:
+- name: Disable Defender Spynet Reporting
+  file: endpoint/disable_defender_spynet_reporting.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disable_defender_submit_samples_consent_feature.test.yml b/tests/endpoint/disable_defender_submit_samples_consent_feature.test.yml
new file mode 100644
index 0000000000..f981577b65
--- /dev/null
+++ b/tests/endpoint/disable_defender_submit_samples_consent_feature.test.yml
@@ -0,0 +1,12 @@
+name: Disable Defender Submit Samples Consent Feature Unit Test
+tests:
+- name: Disable Defender Submit Samples Consent Feature
+  file: endpoint/disable_defender_submit_samples_consent_feature.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disable_schedule_task.test.yml b/tests/endpoint/disable_schedule_task.test.yml
new file mode 100644
index 0000000000..b12f5e2458
--- /dev/null
+++ b/tests/endpoint/disable_schedule_task.test.yml
@@ -0,0 +1,12 @@
+name: Disable Schedule Task Unit Test
+tests:
+- name: Disable Schedule Task
+  file: endpoint/disable_schedule_task.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_schtask/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From fc7e90bd37d113a628ba60f7785b58eafece8505 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 18 Oct 2021 17:11:53 +0200
Subject: [PATCH 02/14] iceid_ttps

---
 .../disable_defender_antivirus_registry.yml   | 67 +++++++++++++++++++
 .../disable_defender_mpengine_registry.yml    | 67 +++++++++++++++++++
 ...sable_defender_antivirus_registry.test.yml | 12 ++++
 ...isable_defender_mpengine_registry.test.yml | 12 ++++
 4 files changed, 158 insertions(+)
 create mode 100644 detections/endpoint/disable_defender_antivirus_registry.yml
 create mode 100644 detections/endpoint/disable_defender_mpengine_registry.yml
 create mode 100644 tests/endpoint/disable_defender_antivirus_registry.test.yml
 create mode 100644 tests/endpoint/disable_defender_mpengine_registry.test.yml

diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml
new file mode 100644
index 0000000000..90119c46e5
--- /dev/null
+++ b/detections/endpoint/disable_defender_antivirus_registry.yml
@@ -0,0 +1,67 @@
+name: Disable Defender AntiVirus Registry
+id: aa4f695a-3024-11ec-9987-acde48001122
+version: 1
+date: '2021-10-18'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint
+  and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple
+  registry and scheduled task modifications will occur. During triage, review parallel
+  processes and identify any further file modifications. Endpoint should be isolated.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" 
+  Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data = 0x00000001
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)` 
+  | `disable_defender_antivirus_registry_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: admin or user may choose to disable windows defender product
+references:
+-  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IceID
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml
new file mode 100644
index 0000000000..91a981b64b
--- /dev/null
+++ b/detections/endpoint/disable_defender_mpengine_registry.yml
@@ -0,0 +1,67 @@
+name: Disable Defender MpEngine Registry
+id: cc391750-3024-11ec-955a-acde48001122
+version: 1
+date: '2021-10-18'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint
+  and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple
+  registry and scheduled task modifications will occur. During triage, review parallel
+  processes and identify any further file modifications. Endpoint should be isolated.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" 
+  Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)`
+  | `disable_defender_mpengine_registry_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: admin or user may choose to disable windows defender product
+references:
+-  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IceID
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/tests/endpoint/disable_defender_antivirus_registry.test.yml b/tests/endpoint/disable_defender_antivirus_registry.test.yml
new file mode 100644
index 0000000000..7bc896bf0d
--- /dev/null
+++ b/tests/endpoint/disable_defender_antivirus_registry.test.yml
@@ -0,0 +1,12 @@
+name: Disable Defender AntiVirus Registry Unit Test
+tests:
+- name: Disable Defender AntiVirus Registry
+  file: endpoint/disable_defender_antivirus_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disable_defender_mpengine_registry.test.yml b/tests/endpoint/disable_defender_mpengine_registry.test.yml
new file mode 100644
index 0000000000..a54f28cc63
--- /dev/null
+++ b/tests/endpoint/disable_defender_mpengine_registry.test.yml
@@ -0,0 +1,12 @@
+name: Disable Defender MpEngine Registry Unit Test
+tests:
+- name: Disable Defender MpEngine Registry
+  file: endpoint/disable_defender_mpengine_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 6048d9697ae986b8259c350da8f967347b2fe353 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-80-141>
Date: Tue, 19 Oct 2021 08:42:46 +0000
Subject: [PATCH 03/14] Added detection testing service results inDisable
 Schedule Task

---
 detections/endpoint/disable_schedule_task.yml | 36 ++++++++++---------
 1 file changed, 19 insertions(+), 17 deletions(-)

diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml
index eea1f120c4..b860cc10a7 100644
--- a/detections/endpoint/disable_schedule_task.yml
+++ b/detections/endpoint/disable_schedule_task.yml
@@ -6,24 +6,25 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious commandline to disable existing schedule task. 
-  This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) 
-  in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this 
-  detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process_name=schtasks.exe Processes.process=*/change*  Processes.process=*/disable*
-  by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest 
-  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+description: This analytic is to detect a suspicious commandline to disable existing
+  schedule task. This technique is used by adversaries or commodity malware like IceID
+  to disable security application (AV products) in the targetted host to evade detections.
+  This TTP is a good pivot to check further why and what other process run before
+  and after this detection. check which process execute the commandline and what task
+  is disabled. parent child process is quite valuable in this scenario too.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
+  Processes.process=*/change*  Processes.process=*/disable* by Processes.user Processes.process_name
+  Processes.process Processes.parent_process_name Processes.parent_process Processes.dest
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `disable_schedule_task_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: admin may disable problematic schedule task
 references:
--  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IcedID
@@ -40,21 +41,22 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.user 
+  - Processes.user
   - Processes.process_name
-  - Processes.parent_process_name 
+  - Processes.parent_process_name
   - Processes.dest
   security_domain: endpoint
   impact: 70
   confidence: 80
-  # (impact * confidence)/100
   risk_score: 56
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: schtask process with commandline $process$ to disable schedule task in $dest$
+  message: schtask process with commandline $process$ to disable schedule task in
+    $dest$
   observable:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 498f4643378c109f6f7e62e24171d90f633781f7 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-86-154>
Date: Tue, 19 Oct 2021 09:28:48 +0000
Subject: [PATCH 04/14] Added detection testing service results inDisable
 Defender Submit Samples Consent Feature

---
 ...efender_submit_samples_consent_feature.yml | 23 +++++++++----------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
index 3c6ea56011..be958ac203 100644
--- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
+++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
@@ -6,23 +6,22 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: his analytic is to detect a suspicious modification of registry to disable windows defender feature. 
-  This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+description: his analytic is to detect a suspicious modification of registry to disable
+  windows defender feature. This technique is to bypassed or evade detection from
+  Windows Defender AV product specially the submit samples feature for further analysis..
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" 
-  Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000
-  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(lastTime)` 
-  | `security_content_ctime(firstTime)` 
-  | `disable_defender_submit_samples_consent_feature_filter`'
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows
+  Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data
+  = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `disable_defender_submit_samples_consent_feature_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: admin or user may choose to disable windows defender product
 references:
--  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -62,4 +61,4 @@ tags:
     type: user
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed

From a201b8728597c0fe5f3b445cf77c6a3b0ee4b8dc Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-128-143>
Date: Tue, 19 Oct 2021 10:00:24 +0000
Subject: [PATCH 05/14] Added detection testing service results inDisable
 Defender Spynet Reporting

---
 .../disable_defender_spynet_reporting.yml     | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml
index 66a81374e6..d260e3ea1e 100644
--- a/detections/endpoint/disable_defender_spynet_reporting.yml
+++ b/detections/endpoint/disable_defender_spynet_reporting.yml
@@ -6,23 +6,22 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. 
-  This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
+description: This analytic is to detect a suspicious modification of registry to disable
+  windows defender feature. This technique is to bypassed or evade detection from
+  Windows Defender AV product specially the spynet reporting for its telemetry.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" 
-  Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000
-  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(lastTime)` 
-  | `security_content_ctime(firstTime)` 
-  | `disable_defender_spynet_reporting_filter`'
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows
+  Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data
+  = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `disable_defender_spynet_reporting_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: admin or user may choose to disable windows defender product
 references:
--  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -61,4 +60,5 @@ tags:
   - name: user
     type: user
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From dba4e97378b57a0e35608f6b7e0b71c4b259514c Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-29-98>
Date: Tue, 19 Oct 2021 10:24:05 +0000
Subject: [PATCH 06/14] Added detection testing service results inDisable
 Defender MpEngine Registry

---
 .../disable_defender_mpengine_registry.yml    | 27 +++++++++----------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml
index 91a981b64b..dff958e4a1 100644
--- a/detections/endpoint/disable_defender_mpengine_registry.yml
+++ b/detections/endpoint/disable_defender_mpengine_registry.yml
@@ -6,25 +6,24 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint
-  and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple
-  registry and scheduled task modifications will occur. During triage, review parallel
-  processes and identify any further file modifications. Endpoint should be isolated.
+description: This particular behavior is typically executed when an adversaries or
+  malware gains access to an endpoint and beings to perform execution and to evade
+  detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
+  task modifications will occur. During triage, review parallel processes and identify
+  any further file modifications. Endpoint should be isolated.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" 
-  Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000
-  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(lastTime)` 
-  | `security_content_ctime(firstTime)`
-  | `disable_defender_mpengine_registry_filter`'
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows
+  Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data
+  = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `disable_defender_mpengine_registry_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: admin or user may choose to disable windows defender product
 references:
--  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -64,4 +63,4 @@ tags:
     type: user
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 810f878c7fe6b6a1b669ad33ec7d9a4be3a3db5b Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-85-239>
Date: Tue, 19 Oct 2021 10:55:31 +0000
Subject: [PATCH 07/14] Added detection testing service results inDisable
 Defender Enhanced Notification

---
 ...disable_defender_enhanced_notification.yml | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml
index fd1149d3c4..c8f630c8c0 100644
--- a/detections/endpoint/disable_defender_enhanced_notification.yml
+++ b/detections/endpoint/disable_defender_enhanced_notification.yml
@@ -6,24 +6,23 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. 
-  This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user 
+description: This analytic is to detect a suspicious modification of registry to disable
+  windows defender feature. This technique is to bypassed or evade detection from
+  Windows Defender AV product specially the Enhanced Notification feature wher user
   or admin set to show or display alerts.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" 
-  Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001
-  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(lastTime)` 
-  | `security_content_ctime(firstTime)` 
-  | `disable_defender_enhanced_notification_filter`'
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows
+  Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications
+  Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_enhanced_notification_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 known_false_positives: user may choose to disable windows defender AV
 references:
--  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -62,4 +61,5 @@ tags:
   - name: user
     type: user
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 8cc1b518070eaef9ad9f20593df6de6bb44c1688 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-53-21>
Date: Tue, 19 Oct 2021 11:19:35 +0000
Subject: [PATCH 08/14] Added detection testing service results inDisable
 Defender BlockAtFirstSeen Feature

---
 ...able_defender_blockatfirstseen_feature.yml | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
index 5972b9a024..fb7eb3748a 100644
--- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
+++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
@@ -6,24 +6,23 @@ author: Teoderick Contreras
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. 
-  This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it 
-  block suspicious file first seen in the host.
+description: This analytic is to detect a suspicious modification of registry to disable
+  windows defender feature. This technique is to bypassed or evade detection from
+  Windows Defender AV product specially the BlockAtFirstSeen feature where it block
+  suspicious file first seen in the host.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" 
-  Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001
-  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(lastTime)` 
-  | `security_content_ctime(firstTime)`
-  | `disable_defender_blockatfirstseen_feature_filter`'
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows
+  Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data
+  = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `disable_defender_blockatfirstseen_feature_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: admin or user may choose to disable windows defender product
 references:
--  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -62,4 +61,5 @@ tags:
   - name: user
     type: user
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 590722abf912badd89556b3cb4a79d514dc36159 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-200-158>
Date: Tue, 19 Oct 2021 13:20:04 +0000
Subject: [PATCH 09/14] Added detection testing service results inDisable
 Defender AntiVirus Registry

---
 .../disable_defender_antivirus_registry.yml   | 27 +++++++++----------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml
index 90119c46e5..37f725bee4 100644
--- a/detections/endpoint/disable_defender_antivirus_registry.yml
+++ b/detections/endpoint/disable_defender_antivirus_registry.yml
@@ -6,25 +6,24 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint
-  and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple
-  registry and scheduled task modifications will occur. During triage, review parallel
-  processes and identify any further file modifications. Endpoint should be isolated.
+description: This particular behavior is typically executed when an adversaries or
+  malware gains access to an endpoint and beings to perform execution and to evade
+  detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
+  task modifications will occur. During triage, review parallel processes and identify
+  any further file modifications. Endpoint should be isolated.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" 
-  Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data = 0x00000001
-  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(lastTime)` 
-  | `security_content_ctime(firstTime)` 
-  | `disable_defender_antivirus_registry_filter`'
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows
+  Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data
+  = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `disable_defender_antivirus_registry_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: admin or user may choose to disable windows defender product
 references:
--  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -64,4 +63,4 @@ tags:
     type: user
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed

From efdc9df9d5bec22bd2d0326348bb063a7beda3f5 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 20 Oct 2021 11:38:22 +0200
Subject: [PATCH 10/14] iceid_ttps

---
 .../disable_defender_antivirus_registry.yml   |  4 +-
 ...able_defender_blockatfirstseen_feature.yml |  4 +-
 ...disable_defender_enhanced_notification.yml |  6 +-
 .../disable_defender_mpengine_registry.yml    |  4 +-
 .../disable_defender_spynet_reporting.yml     |  4 +-
 ...efender_submit_samples_consent_feature.yml |  2 +-
 .../endpoint/disabling_defender_services.yml  | 69 +++++++++++++++++
 ...wmic_noninteractive_app_uninstallation.yml | 77 +++++++++++++++++++
 .../disabling_defender_services.test.yml      | 12 +++
 ...noninteractive_app_uninstallation.test.yml | 12 +++
 10 files changed, 182 insertions(+), 12 deletions(-)
 create mode 100644 detections/endpoint/disabling_defender_services.yml
 create mode 100644 detections/endpoint/wmic_noninteractive_app_uninstallation.yml
 create mode 100644 tests/endpoint/disabling_defender_services.test.yml
 create mode 100644 tests/endpoint/wmic_noninteractive_app_uninstallation.test.yml

diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml
index 37f725bee4..be393f739c 100644
--- a/detections/endpoint/disable_defender_antivirus_registry.yml
+++ b/detections/endpoint/disable_defender_antivirus_registry.yml
@@ -18,7 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `disable_defender_antivirus_registry_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
+  logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
 known_false_positives: admin or user may choose to disable windows defender product
@@ -53,7 +53,7 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  message: modified/added/deleted registry entry $registry_path$ in $dest$
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
index fb7eb3748a..24d821cbba 100644
--- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
+++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `disable_defender_blockatfirstseen_feature_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
+  logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
 known_false_positives: admin or user may choose to disable windows defender product
@@ -52,7 +52,7 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  message: modified/added/deleted registry entry $registry_path$ in $dest$
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml
index c8f630c8c0..3f349bd1ed 100644
--- a/detections/endpoint/disable_defender_enhanced_notification.yml
+++ b/detections/endpoint/disable_defender_enhanced_notification.yml
@@ -17,9 +17,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)`
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_enhanced_notification_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
+  logs with the registry value name, registry path, and registry value data executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+  Sysmon TA. 
 known_false_positives: user may choose to disable windows defender AV
 references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
@@ -52,7 +52,7 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  message: modified/added/deleted registry entry $registry_path$ in $dest$
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml
index dff958e4a1..9004ac9271 100644
--- a/detections/endpoint/disable_defender_mpengine_registry.yml
+++ b/detections/endpoint/disable_defender_mpengine_registry.yml
@@ -18,7 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `disable_defender_mpengine_registry_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
+  logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
 known_false_positives: admin or user may choose to disable windows defender product
@@ -53,7 +53,7 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  message: modified/added/deleted registry entry $registry_path$ in $dest$
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml
index d260e3ea1e..a7816063bd 100644
--- a/detections/endpoint/disable_defender_spynet_reporting.yml
+++ b/detections/endpoint/disable_defender_spynet_reporting.yml
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `disable_defender_spynet_reporting_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
+  logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
 known_false_positives: admin or user may choose to disable windows defender product
@@ -51,7 +51,7 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  message: modified/added/deleted registry entry $registry_path$ in $dest$
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
index be958ac203..864719bfca 100644
--- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
+++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `disable_defender_submit_samples_consent_feature_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
+  logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
 known_false_positives: admin or user may choose to disable windows defender product
diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml
new file mode 100644
index 0000000000..b47d9ee397
--- /dev/null
+++ b/detections/endpoint/disabling_defender_services.yml
@@ -0,0 +1,69 @@
+name: Disabling Defender Services
+id: 911eacdc-317f-11ec-ad30-acde48001122
+version: 1
+date: '2021-10-20'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This particular behavior is typically executed when an adversaries or
+  malware gains access to an endpoint and beings to perform execution and to evade
+  detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
+  task modifications will occur. During triage, review parallel processes and identify
+  any further file modifications. Endpoint should be isolated.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" 
+  AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*", "*WinDefend*", "*SecurityHealthService*"))  AND 
+  Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)`
+  | `disabling_defender_services_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: admin or user may choose to disable windows defender product
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IceID
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: modified/added/deleted registry entry $registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
new file mode 100644
index 0000000000..27ddbcc564
--- /dev/null
+++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
@@ -0,0 +1,77 @@
+name: Wmic NonInteractive App Uninstallation
+id: bff0e7a0-317f-11ec-ab4e-acde48001122
+version: 1
+date: '2021-10-20'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious wmic commandlined that uninstall application non interactively. 
+  This technique was seen in IceID to uninstall av products to the compromised host to bypassed and evade detections. 
+  This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. 
+  This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe
+  Processes.process="* product *" Processes.process="*where name*" Processes.process="*call uninstall*" Processes.process="*/nointeractive*" 
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id
+  Processes.parent_process_id 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `wmic_noninteractive_app_uninstallation_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: third party application may use this approach to uninstall there application
+references:
+-  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IceID
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: wmic $process$ with commandline $process$ in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Target
\ No newline at end of file
diff --git a/tests/endpoint/disabling_defender_services.test.yml b/tests/endpoint/disabling_defender_services.test.yml
new file mode 100644
index 0000000000..c22cc73c4f
--- /dev/null
+++ b/tests/endpoint/disabling_defender_services.test.yml
@@ -0,0 +1,12 @@
+name: Disabling Defender Services Unit Test
+tests:
+- name: Disabling Defender Services
+  file: endpoint/disabling_defender_services.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon2.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/wmic_noninteractive_app_uninstallation.test.yml b/tests/endpoint/wmic_noninteractive_app_uninstallation.test.yml
new file mode 100644
index 0000000000..1bf7a12066
--- /dev/null
+++ b/tests/endpoint/wmic_noninteractive_app_uninstallation.test.yml
@@ -0,0 +1,12 @@
+name: Wmic NonInteractive App Uninstallation Unit Test
+tests:
+- name: Wmic NonInteractive App Uninstallation
+  file: endpoint/wmic_noninteractive_app_uninstallation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon2.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 50f4a08cca63e64b8f57f54cb9803c82ed43ca46 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-7-25>
Date: Wed, 20 Oct 2021 12:01:43 +0000
Subject: [PATCH 11/14] Added detection testing service results inWmic
 NonInteractive App Uninstallation

---
 ...wmic_noninteractive_app_uninstallation.yml | 34 ++++++++++---------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
index 27ddbcc564..f6a49d4547 100644
--- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
+++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
@@ -6,26 +6,28 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious wmic commandlined that uninstall application non interactively. 
-  This technique was seen in IceID to uninstall av products to the compromised host to bypassed and evade detections. 
-  This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. 
-  This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+description: This analytic is to detect a suspicious wmic commandlined that uninstall
+  application non interactively. This technique was seen in IceID to uninstall av
+  products to the compromised host to bypassed and evade detections. This Hunting
+  query maybe a good indicator that some process tries to uninstall application using
+  wmic which is not a common behavior. This approach may seen in some script or third
+  part appication to uninstall their application but it is a good thing to check what
+  it uninstall and why.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe
-  Processes.process="* product *" Processes.process="*where name*" Processes.process="*call uninstall*" Processes.process="*/nointeractive*" 
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id
-  Processes.parent_process_id 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `wmic_noninteractive_app_uninstallation_filter`'
+  Processes.process="* product *" Processes.process="*where name*" Processes.process="*call
+  uninstall*" Processes.process="*/nointeractive*" by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_noninteractive_app_uninstallation_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: third party application may use this approach to uninstall there application
+  Sysmon TA.
+known_false_positives: third party application may use this approach to uninstall
+  there application
 references:
--  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -56,7 +58,6 @@ tags:
   security_domain: endpoint
   impact: 50
   confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
   context:
   - Source:Endpoint
@@ -74,4 +75,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Target
\ No newline at end of file
+    - Target
+  automated_detection_testing: passed

From ca54d339dae1a9643817184d2cb3f234a045ee31 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-53-20>
Date: Thu, 21 Oct 2021 10:10:35 +0000
Subject: [PATCH 12/14] Added detection testing service results inDisabling
 Defender Services

---
 .../endpoint/disabling_defender_services.yml     | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml
index b47d9ee397..ea6063fb95 100644
--- a/detections/endpoint/disabling_defender_services.yml
+++ b/detections/endpoint/disabling_defender_services.yml
@@ -12,14 +12,12 @@ description: This particular behavior is typically executed when an adversaries
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" 
-  AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*", "*WinDefend*", "*SecurityHealthService*"))  AND 
-  Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004
-  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(lastTime)`
-  | `security_content_ctime(firstTime)`
-  | `disabling_defender_services_filter`'
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*"
+  AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*",
+  "*WinDefend*", "*SecurityHealthService*"))  AND Registry.registry_value_name = Start
+  Registry.registry_value_data = 0x00000004 by Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disabling_defender_services_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -66,4 +64,4 @@ tags:
     type: user
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed

From bb1a684667f2578f273f31e835162855cea4874f Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 21 Oct 2021 12:24:22 +0200
Subject: [PATCH 13/14] iceid_ttps

---
 ...cmd_carry_out_string_command_parameter.yml | 70 +++++++++++++++++++
 ...arry_out_string_command_parameter.test.yml | 12 ++++
 2 files changed, 82 insertions(+)
 create mode 100644 detections/endpoint/cmd_carry_out_string_command_parameter.yml
 create mode 100644 tests/endpoint/cmd_carry_out_string_command_parameter.test.yml

diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
new file mode 100644
index 0000000000..06eee6de2b
--- /dev/null
+++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -0,0 +1,70 @@
+name: CMD Carry Out String Command Parameter
+id: 54a6ed00-3256-11ec-b031-acde48001122
+version: 1
+date: '2021-10-21'
+author: Teoderick Contreras, Splunk, Bhavin Patel, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This search looks for command-line arguments where `cmd.exe /c` is used
+  to execute a program. This technique is commonly seen in adversaries and malware to execute batch command using different shell like powershell 
+  or different process other than cmd.exe. This is a good hunting query for suspicious commandline made by a script or relative process 
+  execute it. 
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd`
+  AND Processes.process="* /c *" by Processes.dest Processes.user Processes.parent_process 
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `cmd_carry_out_string_command_parameter_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: unknown
+references:
+-  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IcedID
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.003
+  - T1059
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id 
+  - Processes.parent_process_id 
+  security_domain: endpoint
+  impact: 60
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 30
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/cmd_carry_out_string_command_parameter.test.yml b/tests/endpoint/cmd_carry_out_string_command_parameter.test.yml
new file mode 100644
index 0000000000..c39f5caf49
--- /dev/null
+++ b/tests/endpoint/cmd_carry_out_string_command_parameter.test.yml
@@ -0,0 +1,12 @@
+name: CMD Carry Out String Command Parameter Unit Test
+tests:
+- name: CMD Carry Out String Command Parameter
+  file: endpoint/cmd_carry_out_string_command_parameter.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 0f12c3141a0ddc2d896571d2c8353f3e5bac037a Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-239-128>
Date: Thu, 21 Oct 2021 10:46:20 +0000
Subject: [PATCH 14/14] Added detection testing service results inCMD Carry Out
 String Command Parameter

---
 ...cmd_carry_out_string_command_parameter.yml | 29 +++++++++----------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
index 06eee6de2b..5d3290232e 100644
--- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml
+++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -7,24 +7,23 @@ type: Hunting
 datamodel:
 - Endpoint
 description: This search looks for command-line arguments where `cmd.exe /c` is used
-  to execute a program. This technique is commonly seen in adversaries and malware to execute batch command using different shell like powershell 
-  or different process other than cmd.exe. This is a good hunting query for suspicious commandline made by a script or relative process 
-  execute it. 
+  to execute a program. This technique is commonly seen in adversaries and malware
+  to execute batch command using different shell like powershell or different process
+  other than cmd.exe. This is a good hunting query for suspicious commandline made
+  by a script or relative process execute it.
 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_cmd`
-  AND Processes.process="* /c *" by Processes.dest Processes.user Processes.parent_process 
-  Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
-  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="*
+  /c *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `cmd_carry_out_string_command_parameter_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: unknown
 references:
--  https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IcedID
@@ -48,12 +47,11 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.process_id 
-  - Processes.parent_process_id 
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
   impact: 60
   confidence: 50
-  # (impact * confidence)/100
   risk_score: 30
   context:
   - Source:Endpoint
@@ -67,4 +65,5 @@ tags:
   - name: user
     type: User
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed