From fbb5c6ab701c4642c920e929f786699ba97e8f03 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Mar 2022 12:53:17 -0700
Subject: [PATCH 01/15] msbuild

---
 ...sa___windows_script_host_spawn_msbuild.yml | 90 +++++++++++++++++++
 ...windows_script_host_spawn_msbuild.test.yml |  9 ++
 2 files changed, 99 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
 create mode 100644 tests/endpoint/ssa___windows_script_host_spawn_msbuild.test.yml

diff --git a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
new file mode 100644
index 0000000000..1b078d6df1
--- /dev/null
+++ b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
@@ -0,0 +1,90 @@
+name: Windows Script Host Spawn MSBuild
+id: 92886f1c-9b11-11ec-848a-acde48001122
+version: 1
+date: '2022-03-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious child process of MSBuild spawned
+  by Windows Script Host - cscript or wscript. This behavior or event are commonly
+  seen and used by malware or adversaries to execute malicious msbuild process using
+  malicious script in the compromised host. During triage, review parallel processes
+  and identify any file modifications. MSBuild may load a script from the same path
+  without having command-line arguments.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where parent_process_name="wscript.exe" OR parent_process_name="cscript.exe" AND process_name="msbuild.exe"
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited as developers do not spawn
+  MSBuild via a WSH.
+references:
+- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#
+- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1127.001_MSBuild/InvokeMSBuild.ps1
+tags:
+  analytic_story:
+  - Trusted Developer Utilities Proxy Execution MSBuild
+  - Living Off The Land
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1127.001
+  - T1127
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$.
+  nist:
+  - PR.PT
+  - DE.CM
+  cis20:
+  - CIS 8
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_script_host_spawn_msbuild.test.yml b/tests/endpoint/ssa___windows_script_host_spawn_msbuild.test.yml
new file mode 100644
index 0000000000..11f6d94108
--- /dev/null
+++ b/tests/endpoint/ssa___windows_script_host_spawn_msbuild.test.yml
@@ -0,0 +1,9 @@
+name: Windows Script Host Spawn MSBuild Unit Test
+tests:
+- name: Windows Script Host Spawn MSBuild
+  file: endpoint/ssa___windows_script_host_spawn_msbuild.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file

From 545c3dabc559484aa39ff6bfd85c439a7322f088 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Mar 2022 13:24:35 -0700
Subject: [PATCH 02/15] Update ssa___windows_script_host_spawn_msbuild.yml

---
 detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
index 1b078d6df1..126120fd65 100644
--- a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
+++ b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
@@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where parent_process_name="wscript.exe" OR parent_process_name="cscript.exe" AND process_name="msbuild.exe"
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where (parent_process_name LIKE "%wscript.exe" OR parent_process_name LIKE "%cscript.exe%") AND process_name="msbuild.exe"
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",

From d57ee25f189c9b0f3ca53017243415a9f824593e Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Mar 2022 15:01:10 -0700
Subject: [PATCH 03/15] msb

---
 .../ssa___windows_wmiprvse_spawn_msbuild.yml  | 91 +++++++++++++++++++
 ...windows_script_host_spawn_msbuild.test.yml |  2 +-
 ...___windows_wmiprvse_spawn_msbuild.test.yml |  9 ++
 3 files changed, 101 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
 create mode 100644 tests/endpoint/ssa___windows_wmiprvse_spawn_msbuild.test.yml

diff --git a/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
new file mode 100644
index 0000000000..86cc54f482
--- /dev/null
+++ b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
@@ -0,0 +1,91 @@
+name: Windows WMIPrvse Spawn MSBuild
+id: 76b3b290-9b31-11ec-a934-acde48001122
+version: 1
+date: '2022-03-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies wmiprvse.exe spawning msbuild.exe.
+  This behavior is indicative of a COM object being utilized to spawn msbuild from
+  wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using
+  Visual Studio. In this instance, there will be command line arguments and file paths.
+  In a malicious instance, MSBuild.exe will spawn from non-standard processes and
+  have no command line arguments. For example, MSBuild.exe spawning from explorer.exe,
+  powershell.exe is far less common and should be investigated.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where parent_process_name LIKE "%wmiprvse.exe%" AND process_name="msbuild.exe"
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+tags:
+  analytic_story:
+  - Trusted Developer Utilities Proxy Execution MSBuild
+  - Living Off The Land
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1127
+  - T1127.001
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$.
+  nist:
+  - PR.PT
+  - DE.CM
+  cis20:
+  - CIS 8
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_script_host_spawn_msbuild.test.yml b/tests/endpoint/ssa___windows_script_host_spawn_msbuild.test.yml
index 11f6d94108..d338f3f944 100644
--- a/tests/endpoint/ssa___windows_script_host_spawn_msbuild.test.yml
+++ b/tests/endpoint/ssa___windows_script_host_spawn_msbuild.test.yml
@@ -4,6 +4,6 @@ tests:
   file: endpoint/ssa___windows_script_host_spawn_msbuild.yml
   pass_condition: '@count_gt(0)'
   attack_data:
-  - file_name: windows-security.log
+  - file_name: msbuild-windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
     source: WinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_wmiprvse_spawn_msbuild.test.yml b/tests/endpoint/ssa___windows_wmiprvse_spawn_msbuild.test.yml
new file mode 100644
index 0000000000..724ccfbe36
--- /dev/null
+++ b/tests/endpoint/ssa___windows_wmiprvse_spawn_msbuild.test.yml
@@ -0,0 +1,9 @@
+name: Windows WMIPrvse Spawn MSBuild Unit Test
+tests:
+- name: Windows WMIPrvse Spawn MSBuild
+  file: endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: msbuild-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file

From f18c6e587f652051bb98d85ee0048591064d82cf Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Mar 2022 15:03:56 -0700
Subject: [PATCH 04/15] fix

---
 detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml | 2 +-
 detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
index 126120fd65..4c5b3c4244 100644
--- a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
+++ b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
@@ -5,7 +5,7 @@ date: '2022-03-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: This analytic is to detect a suspicious child process of MSBuild spawned
   by Windows Script Host - cscript or wscript. This behavior or event are commonly
   seen and used by malware or adversaries to execute malicious msbuild process using
diff --git a/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
index 86cc54f482..e7149574e8 100644
--- a/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
+++ b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
@@ -5,7 +5,7 @@ date: '2022-03-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: The following analytic identifies wmiprvse.exe spawning msbuild.exe.
   This behavior is indicative of a COM object being utilized to spawn msbuild from
   wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using

From 6b4a9fe22cf1dc2ffe6d5ba7d8f1587dd644a45d Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Thu, 3 Mar 2022 16:05:49 -0600
Subject: [PATCH 05/15] lower casing parent_process_name

---
 .../endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml       | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
index 86cc54f482..05fa27458f 100644
--- a/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
+++ b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
@@ -17,8 +17,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
-  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), "string",
+  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where parent_process_name LIKE "%wmiprvse.exe%" AND process_name="msbuild.exe"
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
@@ -88,4 +88,4 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process

From 4f6dea53e5be9c3978dd7f94fca63a30a2a4bef2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 8 Mar 2022 09:55:07 -0700
Subject: [PATCH 06/15] modified path

---
 detections/endpoint/suspicious_msbuild_path.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index a5d11e2305..34d9afd2f5 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -1,7 +1,7 @@
 name: Suspicious msbuild path
 id: f5198224-551c-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-12'
+version: 3
+date: '2022-03-08'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -13,7 +13,7 @@ description: The following analytic identifies msbuild.exe executing from a non-
   there are instances of build applications that will move or use a copy of MSBuild.
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_msbuild` AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v*\\*)
+  as lastTime from datamodel=Endpoint.Processes where `process_msbuild` AND (Processes.process_path!=*\\framework*\\v*\\*)
   by Processes.dest Processes.original_file_name Processes.parent_process Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `suspicious_msbuild_path_filter`'

From 604a6e1cd9d426270409b3e41fd91f9907f49131 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Mar 2022 10:07:10 -0600
Subject: [PATCH 07/15] fix

---
 .../endpoint/ssa___windows_script_host_spawn_msbuild.yml     | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
index 4c5b3c4244..27d8004284 100644
--- a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
+++ b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
@@ -81,10 +81,11 @@ tags:
     role:
     - Victim
   - name: parent_process_name
-    type: Parent Process
+    type: Process Name
     role:
     - Parent Process
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  asset_type: Endpoint
\ No newline at end of file

From 7aaf975e0c14170cf178a20c43ad8f233cc2c907 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Mar 2022 10:14:35 -0600
Subject: [PATCH 08/15]  more fix

---
 detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
index eb1dd3eca9..1b2947eaf7 100644
--- a/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
+++ b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
@@ -82,10 +82,11 @@ tags:
     role:
     - Victim
   - name: parent_process_name
-    type: Parent Process
+    type: Process Name
     role:
     - Parent Process
   - name: process_name
     type: Process
     role:
     - Child Process
+  asset_type: Endpoint
\ No newline at end of file

From 1e473c203764a60b9c26402907d6651f819aa247 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 16 Mar 2022 14:22:52 -0600
Subject: [PATCH 09/15] I Am The Wbadmin

---
 .../endpoint/ssa___wbadmin_delete_system_backups.yml     | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
index 577362f672..20f293bdcf 100644
--- a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
+++ b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
@@ -14,10 +14,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  (cmd_line IS NOT NULL AND process_name IS NOT NULL) AND (process_name="wbadmin.exe"
-  AND like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,
-  "%systemstatebackup%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where (cmd_line IS NOT NULL AND process_name IS NOT NULL)
+  | where (process_name="wbadmin.exe")
+  | where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,  "%systemstatebackup%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name, "process_path", process_path])

From 16f1c70c86ff2648234fa48ab48371dc2e3d5ff6 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Mar 2022 10:25:35 -0600
Subject: [PATCH 10/15] Update ssa___wbadmin_delete_system_backups.yml

---
 dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
index 6af7c5e32c..6d11556498 100644
--- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
+++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
@@ -10,9 +10,9 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  (cmd_line IS NOT NULL AND process_name IS NOT NULL) AND (process_name="wbadmin.exe"
-  AND like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,
-  "%systemstatebackup%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  (cmd_line IS NOT NULL AND process_name IS NOT NULL) | where (process_name="wbadmin.exe")
+  | where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,  "%systemstatebackup%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name, "process_path", process_path])

From 9d6ec3b7f9b5c1c67009bbd94f1f083277db58b5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Mar 2022 10:36:15 -0600
Subject: [PATCH 11/15] Update ssa___wbadmin_delete_system_backups.test.yml

---
 tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
index 03638ce897..40e7d19fd8 100644
--- a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
+++ b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
@@ -5,6 +5,6 @@ tests:
   pass_condition: '@count_gt(0)'
   description: Test detection of WBAdmin Delete System Backups
   attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+  - file_name: windows-security_bcdedit_wbadmin.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

From bfa66e0b8b070055a155c8b128a9591884d873b4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Mar 2022 11:49:22 -0600
Subject: [PATCH 12/15] Update ssa___wbadmin_delete_system_backups.test.yml

---
 tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
index 40e7d19fd8..259154a42e 100644
--- a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
+++ b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
@@ -7,4 +7,4 @@ tests:
   attack_data:
   - file_name: windows-security_bcdedit_wbadmin.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    source: WinEventLog:Security

From 45575026c2b88ac8ef13c9144f2bd748d532e027 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Fri, 18 Mar 2022 12:56:02 -0500
Subject: [PATCH 13/15] Tweak detection

---
 detections/endpoint/ssa___wbadmin_delete_system_backups.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
index 20f293bdcf..a258a3fc4b 100644
--- a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
+++ b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
@@ -16,8 +16,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
   | where (cmd_line IS NOT NULL AND process_name IS NOT NULL)
-  | where (process_name="wbadmin.exe")
-  | where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,  "%systemstatebackup%"))
+  | where process_name="wbadmin.exe"
+  | where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,  "%systemstatebackup%")
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",

From 437f25d4e997faf8043a897517a82becaf957feb Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Mar 2022 11:57:27 -0600
Subject: [PATCH 14/15] Update ssa___wbadmin_delete_system_backups.yml

---
 dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
index 6d11556498..12916987b5 100644
--- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
+++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
@@ -10,8 +10,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  (cmd_line IS NOT NULL AND process_name IS NOT NULL) | where (process_name="wbadmin.exe")
-  | where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,  "%systemstatebackup%"))
+  (cmd_line IS NOT NULL AND process_name IS NOT NULL) | where process_name="wbadmin.exe"
+  | where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,  "%systemstatebackup%")
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
@@ -58,6 +58,6 @@ test:
     file: endpoint/ssa___wbadmin_delete_system_backups.yml
     pass_condition: '@count_gt(0)'
     attack_data:
-    - file_name: windows-sysmon.log
-      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
-      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    - file_name: windows-security_bcdedit_wbadmin.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
+      source: WinEventLog:Security

From d28bcf45f4b3a939c6eca6224a2e2968a59511af Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 18 Mar 2022 12:00:07 -0600
Subject: [PATCH 15/15] Delete ssa___wbadmin_delete_system_backups.yml

---
 .../ssa___wbadmin_delete_system_backups.yml   | 63 -------------------
 1 file changed, 63 deletions(-)
 delete mode 100644 dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml

diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
deleted file mode 100644
index 12916987b5..0000000000
--- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-name: WBAdmin Delete System Backups
-id: 71efbf52-4dbb-4c00-a520-306aa546cbb7
-version: 1
-description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
-  Tool) that delete backup files. This is typically used by ransomware to prevent
-  recovery.
-search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
-  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
-  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
-  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
-  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  (cmd_line IS NOT NULL AND process_name IS NOT NULL) | where process_name="wbadmin.exe"
-  | where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,  "%systemstatebackup%")
-  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
-  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
-  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
-  | into write_ssa_detected_events();'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint_Processess` datamodel.
-known_false_positives: Administrators may modify the boot configuration.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
-- https://thedfirreport.com/2020/10/08/ryuks-return/
-- https://attack.mitre.org/techniques/T1490/
-- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
-tags:
-  analytic_story:
-  - Ryuk Ransomware
-  - Ransomware
-  cis20:
-  - CIS 8
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1490
-  nist:
-  - PR.AC
-  - PR.IP
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - cmd_line
-  risk_score: 15
-  security_domain: endpoint
-  risk_severity: low
-test:
-  name: WBAdmin Delete System Backups Unit Test
-  tests:
-  - name: WBAdmin Delete System Backups
-    file: endpoint/ssa___wbadmin_delete_system_backups.yml
-    pass_condition: '@count_gt(0)'
-    attack_data:
-    - file_name: windows-security_bcdedit_wbadmin.log
-      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
-      source: WinEventLog:Security