updates to ymls

detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml

@@ -37,7 +37,7 @@ tags:
   asset_type: Endpoint
   confidence: 30
   impact: 30
-  message: A pkgmgr.exe executed with package manager xml input file in $dest$
+  message: A pkgmgr.exe executed with package manager xml input file on $dest$
   mitre_attack_id:
   - T1548.002
   observable:
@@ -45,14 +45,10 @@ tags:
     type: User
     role:
     - Victim
-  - name: process_id
-    type: Process
+  - name: dest
+    type: Endpoint
     role:
-    - Attacker
-  - name: file_name
-    type: File Name
-    role:
-    - Attacker
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/windows_mark_of_the_web_bypass.yml

@@ -12,7 +12,7 @@ description: The following analytic identifies a suspicious process that delete
   security restrictions within the Windows Operating System, particularly pertaining to files downloaded from the internet. 
   An example of this scenario is demonstrated by Ave Maria RAT, which attempts to delete this data stream as a means to evade such restrictions.
 search: '`sysmon` EventCode=23 TargetFilename = "*:Zone.Identifier" 
-  | stats  min(_time) as firstTime max(_time) as lastTime count by user EventCode Image TargetFilename ProcessID Computer 
+  | stats  min(_time) as firstTime max(_time) as lastTime count by user EventCode Image TargetFilename ProcessID Computer | rename Computer as dest
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_mark_of_the_web_bypass_filter`'
@@ -28,7 +28,7 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 70
-  message: a mark-of-the-web data stream is deleted in $dest$
+  message: A mark-of-the-web data stream is deleted on $dest$
   mitre_attack_id:
   - T1553.005
   observable:
@@ -36,14 +36,10 @@ tags:
     type: User
     role:
     - Victim
-  - name: Computer
+  - name: dest
     type: Endpoint
     role:
     - Victim
-  - name: deleted_files
-    type: File Name
-    role:
-    - Target
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/windows_unsigned_dll_side_loading.yml

@@ -17,7 +17,7 @@ description: This analysis focuses on detecting potentially malicious unsigned D
   Detecting such suspicious DLLs is crucial in preventing privilege escalation attacks and other potential security breaches. Regular security assessments, thorough monitoring, 
   and implementing security best practices are essential in safeguarding systems from such threats.
 search: '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") 
-  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name Computer EventCode ProcessId Hashes IMPHASH 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name Computer EventCode ProcessId Hashes IMPHASH | rename Computer as dest
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_unsigned_dll_side_loading_filter`'
@@ -33,11 +33,11 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 70
-  message: an unsigned dll module was loaded in $dest$
+  message: An unsigned dll module was loaded on $dest$
   mitre_attack_id:
   - T1574.002
   observable:
-  - name: Computer
+  - name: dest
     type: Endpoint
     role:
     - Victim