Merge branch 'develop' into new-rules

2026-06-08 17:32:49 +00:00 · 2025-02-05 21:39:05 +01:00
parent c50dbd4b46 70aa8403f5
commit fdec3cb64e
274 changed files with 1118 additions and 1082 deletions
@@ -18,7 +18,13 @@ jobs:
          
      - name: Install Python Dependencies and ContentCTL and Atomic Red Team
        run: |
-          pip install contentctl==5.0.0
+          if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then
+            echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}"
+            pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
+          else
+            echo "Installing latest contentctl version"
+            pip install contentctl
+          fi
          git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
          git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
      
@@ -19,7 +19,13 @@ jobs:
          
      - name: Install Python Dependencies and ContentCTL and Atomic Red Team
        run: |
-          pip install contentctl==5.0.0
+          if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then
+            echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}"
+            pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
+          else
+            echo "Installing latest contentctl version"
+            pip install contentctl
+          fi
          git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
          git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
      
@@ -23,7 +23,13 @@ jobs:
        - name: Install Python Dependencies and ContentCTL
          run: |
            python -m pip install --upgrade pip
-            pip install contentctl==5.0.0
+            if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then
+              echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}"
+              pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
+            else
+              echo "Installing latest contentctl version"
+              pip install contentctl
+            fi
           
        # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop
        # Make sure we check out the PR, even if it actually lives in a fork
@@ -3,7 +3,7 @@ app:
  uid: 3449
  title: ES Content Updates
  appid: DA-ESS-ContentUpdate
-  version: 4.44.0
+  version: 5.0.0
  description: Explore the Analytic Stories included with ES Content Updates.
  prefix: ESCU
  label: ESCU
@@ -155,9 +155,9 @@ apps:
 - uid: 3110
  title: Splunk Add-on for Microsoft Cloud Services
  appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES
-  version: 5.4.1
+  version: 5.4.2
  description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_541.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_542.tgz
 - uid: 4055
  title: Splunk Add-on for Microsoft Office 365
  appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365
@@ -10,4 +10,4 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
@@ -11,7 +11,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -11,7 +11,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level
@@ -11,7 +11,7 @@ separator: operationName.localizedValue
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - authorization.action
@@ -11,7 +11,7 @@ separator: operationName.localizedValue
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - authorization.action
@@ -11,7 +11,7 @@ separator: operationName.localizedValue
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - authorization.action
@@ -3,14 +3,17 @@ id: 1997a515-a61a-4f78-ada9-54af34c764f2
 version: 1
 date: '2025-01-13'
 author: Bhavin Patel, Splunk
-description: Data source object for Azure Monitor Activity.  The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.  To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. 
+description: Data source object for Azure Monitor Activity.  The Splunk Add-on for
+  Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure
+  EventHub.  To configure this logging, visit Intune > Tenant administration > Diagnostic
+  settings > Add diagnostic settings & send events to the activity audit event hub.
 source: Azure AD
 sourcetype: azure:monitor:activity
 separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - column
 - action
@@ -93,4 +96,16 @@ fields:
 - vendor_product
 - vendor_region
 - _time
-example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", "Category": 3, "RelationId": null, "TargetDisplayNames": ["<null>"], "TargetObjectIds": ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", "identity": "brian.cove@frothlydev.onmicrosoft.com"}'
+example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388",
+  "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript",
+  "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1,
+  "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4",
+  "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false,
+  "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId":
+  "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"},
+  "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37",
+  "Category": 3, "RelationId": null, "TargetDisplayNames": ["<null>"], "TargetObjectIds":
+  ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name":
+  "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]},
+  "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00",
+  "identity": "brian.cove@frothlydev.onmicrosoft.com"}'
@@ -6,7 +6,10 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Linux Secure
 source: /var/log/secure
 sourcetype: linux_secure
-supported_TA: []
+supported_TA:
+- name: Splunk Add-on for Unix and Linux
+  url: https://splunkbase.splunk.com/app/833
+  version: 9.2.0
 fields:
 - _time
 - action
@@ -1,6 +1,6 @@
 name: PingID Mismatch Auth Source and Verification Response
 id: 15b0694e-caa2-4009-8d83-a1f98b86d086
-version: 4
+version: 5
 date: '2025-01-21'
 author: Steven Dick
 status: production
@@ -1,6 +1,6 @@
 name: Windows AD Suspicious Attribute Modification
 id: 5682052e-ce55-4f9f-8d28-59191420b7e0
-version: 3
+version: 4
 date: '2025-01-21'
 author: Dean Luxton
 status: production
@@ -1,6 +1,6 @@
 name: Windows AD Suspicious GPO Modification
 id: 0a2afc18-a3b5-4452-b60a-2e774214f9bf
-version: 3
+version: 4
 date: '2025-01-21'
 author: Dean Luxton
 status: experimental
@@ -1,6 +1,6 @@
 name: Azure AD Application Administrator Role Assigned
 id: eac4de87-7a56-4538-a21b-277897af6d8d
-version: 6
+version: 7
 date: '2024-11-14'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Azure AD AzureHound UserAgent Detected
 id: d62852db-a1f1-40db-a7fc-c3d56fa8bda3
-version: 1
+version: 2
 date: '2025-01-06'
 author: Dean Luxton 
 data_source:
@@ -1,6 +1,6 @@
 name: Azure AD External Guest User Invited
 id: c1fb4edb-cab1-4359-9b40-925ffd797fb5
-version: 5
+version: 6
 date: '2024-11-14'
 author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Azure AD Multi-Factor Authentication Disabled
 id: 482dd42a-acfa-486b-a0bb-d6fcda27318e
-version: 5
+version: 6
 date: '2024-11-14'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Azure AD Privileged Role Assigned
 id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a
-version: 6
+version: 7
 date: '2024-11-14'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Azure AD Service Principal Enumeration
 id: 3f0647ce-add5-4436-8039-cbd1abe74563
-version: 1
+version: 2
 date: '2025-01-06'
 author: Dean Luxton
 data_source:
@@ -1,6 +1,6 @@
 name: Azure AD Service Principal Owner Added
 id: 7ddf2084-6cf3-4a44-be83-474f7b73c701
-version: 7
+version: 8
 date: '2024-11-14'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Azure AD User Enabled And Password Reset
 id: 1347b9e8-2daa-4a6f-be73-b421d3d9e268
-version: 6
+version: 7
 date: '2024-11-14'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Azure AD User ImmutableId Attribute Updated
 id: 0c0badad-4536-4a84-a561-5ff760f3c00e
-version: 5
+version: 6
 date: '2024-11-14'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: GCP Multi-Factor Authentication Disabled
 id: b9bc5513-6fc1-4821-85a3-e1d81e451c83
-version: 5
+version: 6
 date: '2024-11-14'
 author: Bhavin Patel, Mauricio Velazco, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Gsuite Drive Share In External Email
 id: f6ee02d6-fea0-11eb-b2c2-acde48001122
-version: 4
+version: 5
 date: '2024-11-14'
 author: Teoderick Contreras, Splunk
 status: experimental
@@ -1,6 +1,6 @@
 name: Gsuite Suspicious Shared File Name
 id: 07eed200-03f5-11ec-98fb-acde48001122
-version: 4
+version: 5
 date: '2024-11-14'
 author: Teoderick Contreras, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: O365 Service Principal New Client Credentials
 id: a1b229e9-d962-4222-8c62-905a8a010453
-version: 5
+version: 6
 date: '2024-11-14'
 author: Mauricio Velazco, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Attempt To Stop Security Service
 id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
-version: 9
+version: 10
 date: '2025-01-24'
 author: Rico Valdez, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Attempted Credential Dump From Registry via Reg exe
 id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
-version: 12
+version: 13
 date: '2025-01-15'
 author: Patrick Bareiss, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Cmdline Tool Not Executed In CMD Shell
 id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
-version: 7
+version: 8
 date: '2025-01-24'
 author: Teoderick Contreras, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Create local admin accounts using net exe
 id: b89919ed-fe5f-492c-b139-151bb162040e
-version: 15
+version: 16
 date: '2025-01-24'
 author: Bhavin Patel, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Deleting Of Net Users
 id: 1c8c6f66-acce-11eb-aafb-acde48001122
-version: 7
+version: 8
 date: '2025-01-24'
 author: Teoderick Contreras, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Detect processes used for System Network Configuration Discovery
 id: a51bfe1a-94f0-48cc-b1e4-16ae10145893
-version: 7
+version: 8
 date: '2025-01-24'
 author: Bhavin Patel, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Disabling Net User Account
 id: c0325326-acd6-11eb-98c2-acde48001122
-version: 7
+version: 8
 date: '2025-01-24'
 author: Teoderick Contreras, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Excel Spawning PowerShell
 id: 42d40a22-9be3-11eb-8f08-acde48001122
-version: 7
+version: 8
 date: '2025-01-13'
 author: Michael Haag, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Excel Spawning Windows Script Host
 id: 57fe880a-9be3-11eb-9bf3-acde48001122
-version: 8
+version: 9
 date: '2025-01-13'
 author: Michael Haag, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Excessive Usage Of Net App
 id: 45e52536-ae42-11eb-b5c6-acde48001122
-version: 6
+version: 7
 date: '2025-01-24'
 author: Teoderick Contreras, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Extraction of Registry Hives
 id: 8bbb7d58-b360-11eb-ba21-acde48001122
-version: 6
+version: 7
 date: '2025-01-24'
 author: Michael Haag, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Office Product Spawn CMD Process
 id: b8b19420-e892-11eb-9244-acde48001122
-version: 8
+version: 9
 date: '2025-01-13'
 author: Teoderick Contreras, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Office Product Spawning Windows Script Host
 id: b3628a5b-8d02-42fa-a891-eebf2351cbe1
-version: 10
+version: 11
 date: '2025-01-13'
 author: Michael Haag, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Office Spawning Control
 id: 053e027c-10c7-11ec-8437-acde48001122
-version: 10
+version: 11
 date: '2025-01-24'
 author: Michael Haag, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Osquery pack - ColdRoot detection
 id: a6fffe5e-05c3-4c04-badc-887607fbb8dc
-version: 4
+version: 5
 date: '2024-11-14'
 author: Rico Valdez, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Windows Lateral Tool Transfer RemCom
 id: e373a840-5bdc-47ef-b2fd-9cc7aaf387f0
-version: 5
+version: 6
 date: '2024-12-10'
 author: Michael Haag, Splunk
 type: TTP
@@ -1,6 +1,6 @@
 name: Windows MSIExec With Network Connections
 id: 827409a1-5393-4d8d-8da4-bbb297c262a7
-version: 6
+version: 7
 date: '2025-01-24'
 author: Michael Haag, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Windows Office Product Spawning MSDT
 id: 127eba64-c981-40bf-8589-1830638864a7
-version: 9
+version: 10
 date: '2025-01-24'
 author: Michael Haag, Teoderick Contreras, Splunk
 status: deprecated
@@ -1,6 +1,6 @@
 name: Anomalous usage of 7zip
 id: 9364ee8e-a39a-11eb-8f1d-acde48001122
-version: 6
+version: 7
 date: '2024-11-13'
 author: Michael Haag, Teoderick Contreras, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Any Powershell DownloadFile
 id: 1a93b7ea-7af7-11eb-adb5-acde48001122
-version: 9
+version: 10
 date: '2025-01-27'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Any Powershell DownloadString
 id: 4d015ef2-7adf-11eb-95da-acde48001122
-version: 7
+version: 8
 date: '2024-11-13'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Attempt To Add Certificate To Untrusted Store
 id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
-version: 11
+version: 12
 date: '2024-11-13'
 author: Patrick Bareiss, Rico Valdez, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: BCDEdit Failure Recovery Modification
 id: 809b31d2-5462-11eb-ae93-0242ac130002
-version: 6
+version: 7
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: BITS Job Persistence
 id: e97a5ffe-90bf-11eb-928a-acde48001122
-version: 6
+version: 7
 date: '2024-11-13'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: BITSAdmin Download File
 id: 80630ff4-8e4c-11eb-aab5-acde48001122
-version: 7
+version: 8
 date: '2024-11-13'
 author: Michael Haag, Sittikorn S
 status: production
@@ -1,6 +1,6 @@
 name: CertUtil Download With URLCache and Split Arguments
 id: 415b4306-8bfb-11eb-85c4-acde48001122
-version: 9
+version: 10
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: CertUtil Download With VerifyCtl and Split Arguments
 id: 801ad9e4-8bfb-11eb-8b31-acde48001122
-version: 9
+version: 10
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Certutil exe certificate extraction
 id: 337a46be-600f-11eb-ae93-0242ac130002
-version: 7
+version: 8
 date: '2024-12-10'
 author: Rod Soto, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: CertUtil With Decode Argument
 id: bfe94226-8c10-11eb-a4b3-acde48001122
-version: 6
+version: 7
 date: '2024-11-13'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Check Elevated CMD using whoami
 id: a9079b18-1633-11ec-859c-acde48001122
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Clear Unallocated Sector Using Cipher App
 id: cd80a6ac-c9d9-11eb-8839-acde48001122
-version: 6
+version: 7
 date: '2024-12-10'
 author: Teoderick Contreras, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Clop Common Exec Parameter
 id: 5a8a2a72-8322-11eb-9ee9-acde48001122
-version: 7
+version: 8
 date: '2024-12-10'
 author: Teoderick Contreras, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: CMD Echo Pipe - Escalation
 id: eb277ba0-b96b-11eb-b00e-acde48001122
-version: 7
+version: 8
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Common Ransomware Extensions
 id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
-version: 10
+version: 11
 date: '2025-01-07'
 author: David Dorsey, Michael Haag, Splunk, Steven Dick
 status: production
@@ -1,6 +1,6 @@
 name: Conti Common Exec parameter
 id: 624919bc-c382-11eb-adcc-acde48001122
-version: 6
+version: 7
 date: '2024-12-10'
 author: Teoderick Contreras, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Control Loading from World Writable Directory
 id: 10423ac4-10c9-11ec-8dc4-acde48001122
-version: 6
+version: 7
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Create or delete windows shares using net exe
 id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c
-version: 10
+version: 11
 date: '2024-12-12'
 author: Bhavin Patel, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Deleting Shadow Copies
 id: b89919ed-ee5f-492c-b139-95dbb162039e
-version: 9
+version: 10
 date: '2024-12-10'
 author: David Dorsey, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect AzureHound Command-Line Arguments
 id: 26f02e96-c300-11eb-b611-acde48001122
-version: 7
+version: 8
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect Certify With PowerShell Script Block Logging
 id: f533ca6c-9440-4686-80cb-7f294c07812a
-version: 4
+version: 5
 date: '2024-11-13'
 author: Steven Dick
 status: production
@@ -1,6 +1,6 @@
 name: Detect Certipy File Modifications
 id: 7e3df743-b1d8-4631-8fa8-bd5819688876
-version: 4
+version: 5
 date: '2024-11-13'
 author: Steven Dick
 status: production
@@ -1,6 +1,6 @@
 name: Detect HTML Help Spawn Child Process
 id: 723716de-ee55-4cd4-9759-c44e7e55ba4b
-version: 7
+version: 8
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect HTML Help URL in Command Line
 id: 8c5835b9-39d9-438b-817c-95f14c69a31e
-version: 7
+version: 8
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect Mimikatz With PowerShell Script Block Logging
 id: 8148c29c-c952-11eb-9255-acde48001122
-version: 5
+version: 6
 date: '2024-11-13'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect mshta inline hta execution
 id: a0873b32-5b68-11eb-ae93-0242ac130002
-version: 12
+version: 13
 date: '2024-12-10'
 author: Bhavin Patel, Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect MSHTA Url in Command Line
 id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
-version: 8
+version: 9
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect Path Interception By Creation Of program exe
 id: cbef820c-e1ff-407f-887f-0a9240a2d477
-version: 9
+version: 10
 date: '2024-11-13'
 author: Patrick Bareiss, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect PsExec With accepteula Flag
 id: 27c3a83d-cada-47c6-9042-67baf19d2574
-version: 8
+version: 9
 date: '2024-11-13'
 author: Bhavin Patel, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect RClone Command-Line Usage
 id: 32e0baea-b3f1-11eb-a2ce-acde48001122
-version: 6
+version: 7
 date: '2024-11-13'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect Regasm Spawning a Process
 id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f
-version: 8
+version: 9
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect Regasm with no Command Line Arguments
 id: c3bc1430-04e7-4178-835f-047d8e6e97df
-version: 7
+version: 8
 date: '2024-11-13'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect Regsvcs Spawning a Process
 id: bc477b57-5c21-4ab6-9c33-668772e7f114
-version: 7
+version: 8
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect Regsvcs with No Command Line Arguments
 id: 6b74d578-a02e-4e94-a0d1-39440d0bf254
-version: 7
+version: 8
 date: '2024-11-13'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect Regsvr32 Application Control Bypass
 id: 070e9b80-6252-11eb-ae93-0242ac130002
-version: 7
+version: 8
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect Rundll32 Application Control Bypass - advpack
 id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8
-version: 7
+version: 8
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect Rundll32 Application Control Bypass - setupapi
 id: 61e7b44a-6088-4f26-b788-9a96ba13b37a
-version: 7
+version: 8
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect Rundll32 Application Control Bypass - syssetup
 id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183
-version: 7
+version: 8
 date: '2024-12-10'
 author: Michael Haag, Splunk
 status: production
@@ -1,6 +1,6 @@
 name: Detect suspicious processnames using pretrained model in DSDL
 id: a15f8977-ad7d-4669-92ef-b59b97219bf5
-version: 4
+version: 5
 date: '2024-11-13'
 author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk
 type: Anomaly
--- a/Show More
+++ b/Show More