From a2fb9aca63033b21c212a73af7f311d48502f522 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 1 Dec 2022 23:00:44 +0000
Subject: [PATCH 01/12] Bump attackcti from 0.3.7 to 0.3.8

Bumps [attackcti](https://github.com/OTRF/ATTACK-Python-Client) from 0.3.7 to 0.3.8.
- [Release notes](https://github.com/OTRF/ATTACK-Python-Client/releases)
- [Changelog](https://github.com/OTRF/ATTACK-Python-Client/blob/master/CHANGELOG.md)
- [Commits](https://github.com/OTRF/ATTACK-Python-Client/compare/0.3.7...0.3.8)

---
updated-dependencies:
- dependency-name: attackcti
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index a47a9bf4bd..933f99825b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,4 @@
-attackcti==0.3.7
+attackcti==0.3.8
 docker==6.0.0
 GitPython==3.1.29
 Jinja2==3.1.2

From b2220fc4fd42b2a261c41529295fe1ac35bb25e0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 1 Dec 2022 23:20:23 +0000
Subject: [PATCH 02/12] Bump jsonschema from 4.17.0 to 4.17.3

Bumps [jsonschema](https://github.com/python-jsonschema/jsonschema) from 4.17.0 to 4.17.3.
- [Release notes](https://github.com/python-jsonschema/jsonschema/releases)
- [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/python-jsonschema/jsonschema/compare/v4.17.0...v4.17.3)

---
updated-dependencies:
- dependency-name: jsonschema
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 5e8ecf38b5..f2ffe86020 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,7 +2,7 @@ attackcti==0.3.7
 docker==6.0.0
 GitPython==3.1.29
 Jinja2==3.1.2
-jsonschema==4.17.0
+jsonschema==4.17.3
 mock==4.0.3
 psutil==5.9.4
 pycvesearch==1.2

From 8b9fa991026395e3e3f3d189556d4407de628d41 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Tue, 6 Dec 2022 09:49:29 +0100
Subject: [PATCH 03/12] prestige_winpeas2

---
 ...ws_cached_domain_credentials_reg_query.yml | 81 +++++++++++++++++++
 ...ndows_clipboard_data_via_get_clipboard.yml | 71 ++++++++++++++++
 ...credentials_from_password_stores_query.yml | 79 ++++++++++++++++++
 stories/windows_post_exploitation.yml         | 20 +++++
 ...ched_domain_credentials_reg_query.test.yml | 13 +++
 ..._clipboard_data_via_get_clipboard.test.yml | 13 +++
 ...ntials_from_password_stores_query.test.yml | 13 +++
 7 files changed, 290 insertions(+)
 create mode 100644 detections/endpoint/windows_cached_domain_credentials_reg_query.yml
 create mode 100644 detections/endpoint/windows_clipboard_data_via_get_clipboard.yml
 create mode 100644 detections/endpoint/windows_credentials_from_password_stores_query.yml
 create mode 100644 stories/windows_post_exploitation.yml
 create mode 100644 tests/endpoint/windows_cached_domain_credentials_reg_query.test.yml
 create mode 100644 tests/endpoint/windows_clipboard_data_via_get_clipboard.test.yml
 create mode 100644 tests/endpoint/windows_credentials_from_password_stores_query.test.yml

diff --git a/detections/endpoint/windows_cached_domain_credentials_reg_query.yml b/detections/endpoint/windows_cached_domain_credentials_reg_query.yml
new file mode 100644
index 0000000000..b4016c7779
--- /dev/null
+++ b/detections/endpoint/windows_cached_domain_credentials_reg_query.yml
@@ -0,0 +1,81 @@
+name: Windows Cached Domain Credentials Reg Query
+id: 40ccb8e0-1785-466e-901e-6a8b75c04ecd
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a process command line related to the discovery of cache domain credential logon count in the registry. 
+  This Technique was being abused by several post exploitation tool like Winpeas where it query CachedLogonsCount registry value in 
+  Winlogon registry. This value can be good information about the login caching setting on the Windows OS target host. 
+  A value of 0 means login caching is disable and values > 50 caches only 50 login attempts. By default all versions of Windows 10 save cached logins except 
+  Windows Server 2008. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where  `process_reg` AND Processes.process = "* query *" AND Processes.process = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Processes.process = "*CACHEDLOGONSCOUNT*"
+  by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid 
+  Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_cached_domain_credentials_reg_query_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: unknown
+references:
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+- https://learn.microsoft.com/de-de/troubleshoot/windows-server/user-profiles-and-logon/cached-domain-logon-information
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: a process with commandline $process$ tries to retrieve cache domain credential logon count in $dest$
+  mitre_attack_id:
+  - T1003.005
+  - T1003
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.parent_process_guid 
+  - Processes.process_guid 
+  risk_score: 9
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml
new file mode 100644
index 0000000000..46194b3b69
--- /dev/null
+++ b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml
@@ -0,0 +1,71 @@
+name: Windows ClipBoard Data via Get-ClipBoard
+id: ab73289e-2246-4de0-a14b-67006c72a893
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a powershell script command to retrieve clipboard data. 
+  This technique was seen in several post exploitation tools like WINPEAS to steal sensitive information that was saved in clipboard. 
+  Using the Get-Clipboard powershell commandlet, adversaries can be able collect data stored in clipboard that might be a copied user name, password or 
+  other sensitive information.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-Clipboard*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_clipboard_data_via_get_clipboard_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible there will be false positives, filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1115/
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/powershell/windows-powershell-xml.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: powershell script $ScriptBlockText$ execute Get-Clipboard commandlet in $dest$
+  mitre_attack_id:
+  - T1115
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: UserID
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
+  - EventCode
+  risk_score: 25
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_credentials_from_password_stores_query.yml b/detections/endpoint/windows_credentials_from_password_stores_query.yml
new file mode 100644
index 0000000000..cc9f5e57c5
--- /dev/null
+++ b/detections/endpoint/windows_credentials_from_password_stores_query.yml
@@ -0,0 +1,79 @@
+name: Windows Credentials from Password Stores Query
+id: db02d6b4-5d5b-4c33-8d8f-f0577516a8c7
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a process execution of Windows OS cmdkey.exe tool.
+  This tool is being abused or used by several post exploitation tool such as winpeas that being used by ransomware prestige 
+  to list stored user names, passwords or credentials in the targeted Windows OS host. This information can be used by the attacker 
+  to gain privilege escalation and persistence in the targeted hosts for further attacks.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name="cmdkey.exe" OR Processes.original_file_name = "cmdkey.exe" AND Processes.process = "*/list*"
+  by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid 
+  Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_credentials_from_password_stores_query_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: network administrator can use this tool for auditing process.
+references:
+- https://ss64.com/nt/cmdkey.html
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: a process $process_name$ was executed in $dest$ to display stored username and credentials.
+  mitre_attack_id:
+  - T1555
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.parent_process_guid 
+  - Processes.process_guid 
+  risk_score: 25
+  security_domain: endpoint
diff --git a/stories/windows_post_exploitation.yml b/stories/windows_post_exploitation.yml
new file mode 100644
index 0000000000..f66864de64
--- /dev/null
+++ b/stories/windows_post_exploitation.yml
@@ -0,0 +1,20 @@
+name: Windows Post-Exploitation
+id: 992899b7-a5cf-4bcd-bb0d-cf81762188ba
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+description: This analytic story identifies popular Windows post exploitation tools for example winpeas.bat, winpeas.exe, WinPrivCheck.bat and many more.
+narrative: These tools allow operators to find possible exploits or paths for privilege escalation and persistence on a targeted host. 
+  Ransomware operator like the "Prestige ransomware" also used or abuses these post exploitation tools such as winPEAS to scan for possible avenue to gain privileges and persistence to a targeted 
+  Windows Operating System.
+references:
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story: Windows Post-Exploitation
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring
\ No newline at end of file
diff --git a/tests/endpoint/windows_cached_domain_credentials_reg_query.test.yml b/tests/endpoint/windows_cached_domain_credentials_reg_query.test.yml
new file mode 100644
index 0000000000..fbaeb9a858
--- /dev/null
+++ b/tests/endpoint/windows_cached_domain_credentials_reg_query.test.yml
@@ -0,0 +1,13 @@
+name: Windows Cached Domain Credentials Reg Query Unit Test
+tests:
+- name: Windows Cached Domain Credentials Reg Query
+  file: endpoint/windows_cached_domain_credentials_reg_query.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_clipboard_data_via_get_clipboard.test.yml b/tests/endpoint/windows_clipboard_data_via_get_clipboard.test.yml
new file mode 100644
index 0000000000..79fcf6d32a
--- /dev/null
+++ b/tests/endpoint/windows_clipboard_data_via_get_clipboard.test.yml
@@ -0,0 +1,13 @@
+name: Windows ClipBoard Data via Get-ClipBoard Unit Test
+tests:
+- name: Windows ClipBoard Data via Get-ClipBoard
+  file: endpoint/windows_clipboard_data_via_get_clipboard.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell-xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/powershell/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_credentials_from_password_stores_query.test.yml b/tests/endpoint/windows_credentials_from_password_stores_query.test.yml
new file mode 100644
index 0000000000..55101f559c
--- /dev/null
+++ b/tests/endpoint/windows_credentials_from_password_stores_query.test.yml
@@ -0,0 +1,13 @@
+name: Windows Credentials from Password Stores Query Unit Test
+tests:
+- name: Windows Credentials from Password Stores Query
+  file: endpoint/windows_credentials_from_password_stores_query.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: cmdkey-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 84685334e32aa515346528e6c81f6488c719123f Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 6 Dec 2022 10:18:43 +0100
Subject: [PATCH 04/12] Update windows_clipboard_data_via_get_clipboard.yml

---
 .../endpoint/windows_clipboard_data_via_get_clipboard.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml
index 46194b3b69..96fe91461b 100644
--- a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml
+++ b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml
@@ -38,7 +38,7 @@ tags:
   - Stage:Discovery
   - Stage:Recon
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/powershell/windows-powershell-xml.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/powershell/windows-powershell-xml2.log
   impact: 50
   kill_chain_phases:
   - Exploitation

From 4dec040bf15ac1d64ced586344a38510c8fdef92 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 6 Dec 2022 10:18:58 +0100
Subject: [PATCH 05/12] Update
 windows_clipboard_data_via_get_clipboard.test.yml

---
 .../windows_clipboard_data_via_get_clipboard.test.yml         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_clipboard_data_via_get_clipboard.test.yml b/tests/endpoint/windows_clipboard_data_via_get_clipboard.test.yml
index 79fcf6d32a..bfd5adca49 100644
--- a/tests/endpoint/windows_clipboard_data_via_get_clipboard.test.yml
+++ b/tests/endpoint/windows_clipboard_data_via_get_clipboard.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell-xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/powershell/windows-powershell-xml.log
+  - file_name: windows-powershell-xml2.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/powershell/windows-powershell-xml2.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog
     update_timestamp: true

From df0ba4cfd934d434f28a095685b184495ef47a92 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 7 Dec 2022 09:33:15 +0100
Subject: [PATCH 06/12] prestige_winpeas2

---
 ...dows_credentials_in_registry_reg_query.yml | 82 +++++++++++++++++++
 ...mmand_execution_via_series_of_forfiles.yml | 80 ++++++++++++++++++
 .../windows_information_discovery_fsutil.yml  | 79 ++++++++++++++++++
 ...credentials_in_registry_reg_query.test.yml | 13 +++
 ..._execution_via_series_of_forfiles.test.yml | 13 +++
 ...dows_information_discovery_fsutil.test.yml | 13 +++
 6 files changed, 280 insertions(+)
 create mode 100644 detections/endpoint/windows_credentials_in_registry_reg_query.yml
 create mode 100644 detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml
 create mode 100644 detections/endpoint/windows_information_discovery_fsutil.yml
 create mode 100644 tests/endpoint/windows_credentials_in_registry_reg_query.test.yml
 create mode 100644 tests/endpoint/windows_indirect_command_execution_via_series_of_forfiles.test.yml
 create mode 100644 tests/endpoint/windows_information_discovery_fsutil.test.yml

diff --git a/detections/endpoint/windows_credentials_in_registry_reg_query.yml b/detections/endpoint/windows_credentials_in_registry_reg_query.yml
new file mode 100644
index 0000000000..b98c26fb52
--- /dev/null
+++ b/detections/endpoint/windows_credentials_in_registry_reg_query.yml
@@ -0,0 +1,82 @@
+name: Windows Credentials in Registry Reg Query
+id: a8b3124e-2278-4b73-ae9c-585117079fb2
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a process command line related to the discovery of possible password or credentials in the registry. 
+  This technique is being abused by adversaries or post exploitation tools like winpeas to steal credentials in the registry in the targeted host. 
+  Registry can contain several sensitive information like username and credentials that can be used for privilege escalation, persistence or even in lateral movement. 
+  This Anomaly detection can be a good pivot to detect a suspicious process querying a registry related to password or private keys.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where `process_reg` AND Processes.process = "* query *" AND Processes.process IN ("*\\Software\\ORL\\WinVNC3\\Password*", 
+  "*\\SOFTWARE\\RealVNC\\WinVNC4 /v password*", "*\\CurrentControlSet\\Services\\SNMP*", "*\\Software\\TightVNC\\Server*", 
+  "*\\Software\\SimonTatham\\PuTTY\\Sessions*", "*\\Software\\OpenSSH\\Agent\\Keys*", "*password*")
+  by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid 
+  Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_credentials_in_registry_reg_query_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: unknown
+references:
+- https://attack.mitre.org/techniques/T1552/002/
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: reg query commandline $process$ in $dest$
+  mitre_attack_id:
+  - T1552.002
+  - T1552
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.parent_process_guid 
+  - Processes.process_guid 
+  risk_score: 25
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml
new file mode 100644
index 0000000000..29760ebe5b
--- /dev/null
+++ b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml
@@ -0,0 +1,80 @@
+name: Windows Indirect Command Execution Via Series Of Forfiles
+id: bfdaabe7-3db8-48c5-80c1-220f9b8f22be
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is developed to detect suspicious excessive usage of forfiles.exe process. 
+  This event was seen in post exploitation tool WINPEAS that was used by Ransomware Prestige. Forfiles command 
+  lets you run a command on or pass arguments to multiple files. This Windows OS built-in tool being abused to list all files in specific 
+  directory or drive. 
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_guid) as process_guid  values(Processes.process_name) as process_name
+  count min(_time) as firstTime max(_time) as lastTime  from datamodel=Endpoint.Processes
+  where Processes.process_name = "forfiles.exe" OR Processes.original_file_name = "forfiles.exe" 
+  by Processes.parent_process_name Processes.parent_process Processes.dest Processes.user _time span=1m 
+  | where count >=20 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_indirect_command_execution_via_series_of_forfiles_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: excessive forfiles process execution in $dest$
+  mitre_attack_id:
+  - T1202
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 9
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_information_discovery_fsutil.yml b/detections/endpoint/windows_information_discovery_fsutil.yml
new file mode 100644
index 0000000000..19f605e7c9
--- /dev/null
+++ b/detections/endpoint/windows_information_discovery_fsutil.yml
@@ -0,0 +1,79 @@
+name: Windows Information Discovery Fsutil
+id: 2181f261-93e6-4166-a5a9-47deac58feff
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a process execution of Windows OS built-in tool FSUTIL to discover file system information. 
+  This tool is being abused or used by several adversaries or threat actor to query/list all drives, drive type, 
+  volume information or volume statistics by using the FSINFO parameter of this tool. This technique was seen in 
+  WINPEAS post exploitation tool that is being used by ransomware prestige to gain privilege and persistence to the targeted host.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name="fsutil.exe" OR Processes.original_file_name = "fsutil.exe" AND Processes.process = "*fsinfo*"
+  by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid 
+  Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_information_discovery_fsutil_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: unknown
+references:
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: process $process_name$ with commandline $process$ is executed in $dest$
+  mitre_attack_id:
+  - T1082
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.parent_process_guid 
+  - Processes.process_guid 
+  risk_score: 9
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_credentials_in_registry_reg_query.test.yml b/tests/endpoint/windows_credentials_in_registry_reg_query.test.yml
new file mode 100644
index 0000000000..fb9d7e3e96
--- /dev/null
+++ b/tests/endpoint/windows_credentials_in_registry_reg_query.test.yml
@@ -0,0 +1,13 @@
+name: Windows Credentials in Registry Reg Query Unit Test
+tests:
+- name: Windows Credentials in Registry Reg Query
+  file: endpoint/windows_credentials_in_registry_reg_query.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: query-putty-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_indirect_command_execution_via_series_of_forfiles.test.yml b/tests/endpoint/windows_indirect_command_execution_via_series_of_forfiles.test.yml
new file mode 100644
index 0000000000..0e35da4519
--- /dev/null
+++ b/tests/endpoint/windows_indirect_command_execution_via_series_of_forfiles.test.yml
@@ -0,0 +1,13 @@
+name: Windows Indirect Command Execution Via Series Of Forfiles Unit Test
+tests:
+- name: Windows Indirect Command Execution Via Series Of Forfiles
+  file: endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_information_discovery_fsutil.test.yml b/tests/endpoint/windows_information_discovery_fsutil.test.yml
new file mode 100644
index 0000000000..e3202276e1
--- /dev/null
+++ b/tests/endpoint/windows_information_discovery_fsutil.test.yml
@@ -0,0 +1,13 @@
+name: Windows Information Discovery Fsutil Unit Test
+tests:
+- name: Windows Information Discovery Fsutil
+  file: endpoint/windows_information_discovery_fsutil.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: fsutil-fsinfo-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 3c5f4b7d124382c44aed391bbd6ddfe3d5e5f5e5 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 7 Dec 2022 09:36:39 +0100
Subject: [PATCH 07/12] Update windows_information_discovery_fsutil.yml

---
 detections/endpoint/windows_information_discovery_fsutil.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_information_discovery_fsutil.yml b/detections/endpoint/windows_information_discovery_fsutil.yml
index 19f605e7c9..f44910a83d 100644
--- a/detections/endpoint/windows_information_discovery_fsutil.yml
+++ b/detections/endpoint/windows_information_discovery_fsutil.yml
@@ -3,7 +3,7 @@ id: 2181f261-93e6-4166-a5a9-47deac58feff
 version: 1
 date: '2022-11-30'
 author: Teoderick Contreras, Splunk
-type: Anomaly
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic identifies a process execution of Windows OS built-in tool FSUTIL to discover file system information. 

From 08b24091a948aa8a75c6ad539a01628ee919a4a7 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 8 Dec 2022 09:32:33 +0100
Subject: [PATCH 08/12] prestige_winpeas2

---
 .../windows_password_managers_discovery.yml   | 82 +++++++++++++++++++
 .../windows_private_keys_discovery.yml        | 82 +++++++++++++++++++
 ...ws_security_support_provider_reg_query.yml | 81 ++++++++++++++++++
 ...ndows_password_managers_discovery.test.yml | 13 +++
 .../windows_private_keys_discovery.test.yml   | 13 +++
 ...curity_support_provider_reg_query.test.yml | 13 +++
 6 files changed, 284 insertions(+)
 create mode 100644 detections/endpoint/windows_password_managers_discovery.yml
 create mode 100644 detections/endpoint/windows_private_keys_discovery.yml
 create mode 100644 detections/endpoint/windows_security_support_provider_reg_query.yml
 create mode 100644 tests/endpoint/windows_password_managers_discovery.test.yml
 create mode 100644 tests/endpoint/windows_private_keys_discovery.test.yml
 create mode 100644 tests/endpoint/windows_security_support_provider_reg_query.test.yml

diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml
new file mode 100644
index 0000000000..b7b09402ac
--- /dev/null
+++ b/detections/endpoint/windows_password_managers_discovery.yml
@@ -0,0 +1,82 @@
+name: Windows Password Managers Discovery
+id: a3b3bc96-1c4f-4eba-8218-027cac739a48
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies a process command line that retrieves information related to password manager software. 
+  This technique was seen in several post exploitation tools like winpeas that are being used by Ransomware Prestige to gather this type of information. 
+  Password Managers applications are designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a 
+  user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. 
+  These databases can be stored as files on disk. Due to this password manager software designed adversaries may find or look for keywords related to the Password 
+  Manager databases that can be stolen or extracted for further attacks.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process = "*dir *" OR  Processes.process = "*findstr*"
+  AND Processes.process IN ( "*.kdbx*", "*credential*", "*key3.db*","*pass*", "*cred*", "*key4.db*", "*accessTokens*", "*access_tokens*", "*.htpasswd*", "*Ntds.dit*")
+  by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid 
+  Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_password_managers_discovery_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: unknown
+references:
+- https://attack.mitre.org/techniques/T1555/005/
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: a process with commandline $process$ that can retrieve information related to password manager databases in $dest$
+  mitre_attack_id:
+  - T1555.005
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.parent_process_guid 
+  - Processes.process_guid 
+  risk_score: 25
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_private_keys_discovery.yml b/detections/endpoint/windows_private_keys_discovery.yml
new file mode 100644
index 0000000000..9bb86d7736
--- /dev/null
+++ b/detections/endpoint/windows_private_keys_discovery.yml
@@ -0,0 +1,82 @@
+name: Windows Private Keys Discovery
+id: 5c1c2877-06c0-40ee-a1a2-db71f1372b5b
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a process command line that retrieves information related to private keys files. 
+  This technique was seen in several post exploitation tools like winpeas that are being used by Ransomware Prestige to 
+  search for private key certificates on the compromised host for insecurely stored credentials. This files can be used by adversaries to gain privileges, 
+  persistence or remote service authentication to collect more sensitive information. Some private keys required password for operation, so in this case adversaries 
+  may need to have that passphrase either via keylogging or brute force attack.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process = "*dir *" OR  Processes.process = "*findstr*"
+  AND Processes.process IN ( "*.rdg*", "*.gpg*", "*.pgp*", "*.p12*", "*.der*", "*.csr*", "*.cer*", "*.ovpn*", "*.key*",  "*.ppk*", "*.p12*", "*.pem*", "*.pfx*", "*.p7b*", "*.asc*")
+  by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid 
+  Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_private_keys_discovery_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: unknown
+references:
+- https://attack.mitre.org/techniques/T1552/004/
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - UPDATE_DATASET_URL
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: a process with commandline $process$ that can retrieve information related to private keys in $dest$
+  mitre_attack_id:
+  - T1552.004
+  - T1552
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.parent_process_guid 
+  - Processes.process_guid 
+  risk_score: 25
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_security_support_provider_reg_query.yml b/detections/endpoint/windows_security_support_provider_reg_query.yml
new file mode 100644
index 0000000000..683515d118
--- /dev/null
+++ b/detections/endpoint/windows_security_support_provider_reg_query.yml
@@ -0,0 +1,81 @@
+name: Windows Security Support Provider Reg Query
+id: 31302468-93c9-4eca-9ae3-2d41f53a4e2b
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a process command line related to the discovery of possible Security Support Providers in the registry. 
+  This technique is being abused by adversaries or post exploitation tools like winpeas to gather LSA protection and configuration in the registry in the targeted host. 
+  This registry entry can contain several information related to LSA that validates users for local and remote sign-ins and enforces local security policies.
+  Understanding LSA protection may give a good information in accessing LSA content in memory which is commonly attack by adversaries and tool like mimikatz to 
+  scrape password hashes or clear plain text passwords.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where `process_reg` AND Processes.process = "* query *" AND Processes.process = "*\\SYSTEM\\CurrentControlSet\\Control\\LSA*" Processes.process IN ("*RunAsPPL*" , "*LsaCfgFlags*")
+  by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid 
+  Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_security_support_provider_reg_query_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: unknown
+references:
+- https://blog.netwrix.com/2022/01/11/understanding-lsa-protection/
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: process with reg query command line $process$ in $dest$
+  mitre_attack_id:
+  - T1547.005
+  - T1547
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.parent_process_guid 
+  - Processes.process_guid 
+  risk_score: 9
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_password_managers_discovery.test.yml b/tests/endpoint/windows_password_managers_discovery.test.yml
new file mode 100644
index 0000000000..ada5ef7607
--- /dev/null
+++ b/tests/endpoint/windows_password_managers_discovery.test.yml
@@ -0,0 +1,13 @@
+name: Windows Password Managers Discovery Unit Test
+tests:
+- name: Windows Password Managers Discovery
+  file: endpoint/windows_password_managers_discovery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: dir-db-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_private_keys_discovery.test.yml b/tests/endpoint/windows_private_keys_discovery.test.yml
new file mode 100644
index 0000000000..e12526abb0
--- /dev/null
+++ b/tests/endpoint/windows_private_keys_discovery.test.yml
@@ -0,0 +1,13 @@
+name: Windows Private Keys Discovery Unit Test
+tests:
+- name: Windows Private Keys Discovery
+  file: endpoint/windows_private_keys_discovery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: dir-private-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_security_support_provider_reg_query.test.yml b/tests/endpoint/windows_security_support_provider_reg_query.test.yml
new file mode 100644
index 0000000000..8b18cf0398
--- /dev/null
+++ b/tests/endpoint/windows_security_support_provider_reg_query.test.yml
@@ -0,0 +1,13 @@
+name: Windows Security Support Provider Reg Query Unit Test
+tests:
+- name: Windows Security Support Provider Reg Query
+  file: endpoint/windows_security_support_provider_reg_query.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: UPDATE
+    source: UPDATE
+    sourcetype: UPDATE
+    update_timestamp: true

From 19649ac21bd667877d4e32e41196e939c984d03c Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 8 Dec 2022 09:56:12 +0100
Subject: [PATCH 09/12] Update
 windows_security_support_provider_reg_query.test.yml

---
 .../windows_security_support_provider_reg_query.test.yml  | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/endpoint/windows_security_support_provider_reg_query.test.yml b/tests/endpoint/windows_security_support_provider_reg_query.test.yml
index 8b18cf0398..937cc5a2ac 100644
--- a/tests/endpoint/windows_security_support_provider_reg_query.test.yml
+++ b/tests/endpoint/windows_security_support_provider_reg_query.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: UPDATE
-    data: UPDATE
-    source: UPDATE
-    sourcetype: UPDATE
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
     update_timestamp: true

From c945291138cfb20ffcc8b79a83b0df5d10c99f18 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 12 Dec 2022 11:19:22 +0100
Subject: [PATCH 10/12] prestige_winpeas2

---
 ..._steal_or_forge_kerberos_tickets_klist.yml | 78 ++++++++++++++++++
 ...m_network_config_discovery_display_dns.yml | 80 +++++++++++++++++++
 ...em_network_connections_discovery_netsh.yml | 80 +++++++++++++++++++
 ...l_or_forge_kerberos_tickets_klist.test.yml | 13 +++
 ...work_config_discovery_display_dns.test.yml | 13 +++
 ...twork_connections_discovery_netsh.test.yml | 13 +++
 6 files changed, 277 insertions(+)
 create mode 100644 detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml
 create mode 100644 detections/endpoint/windows_system_network_config_discovery_display_dns.yml
 create mode 100644 detections/endpoint/windows_system_network_connections_discovery_netsh.yml
 create mode 100644 tests/endpoint/windows_steal_or_forge_kerberos_tickets_klist.test.yml
 create mode 100644 tests/endpoint/windows_system_network_config_discovery_display_dns.test.yml
 create mode 100644 tests/endpoint/windows_system_network_connections_discovery_netsh.test.yml

diff --git a/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml
new file mode 100644
index 0000000000..c28654d9d3
--- /dev/null
+++ b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml
@@ -0,0 +1,78 @@
+name: Windows Steal or Forge Kerberos Tickets Klist
+id: 09d88404-1e29-46cb-806c-1eedbc85ad5d
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies a process execution of Windows OS klist.exe tool. 
+  This tool is being abused or used by several post exploitation tool such as winpeas that being used by ransomware prestige
+  to display or gather list of currently cached kerberos ticket. This cahced data can be used for lateral movement or even privilege escalation on the targeted 
+  host. This hunting query can be a good pivot in possible kerberos attack or pass the hash technique. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name="klist.exe" OR Processes.original_file_name = "klist.exe" Processes.parent_process_name IN ("cmd.exe", "powershell*")
+  by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid 
+  Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_steal_or_forge_kerberos_tickets_klist_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: unknown
+references:
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: process klist.exe executed in $dest$
+  mitre_attack_id:
+  - T1558
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.parent_process_guid 
+  - Processes.process_guid 
+  risk_score: 9
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml
new file mode 100644
index 0000000000..8dc73f4e4e
--- /dev/null
+++ b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml
@@ -0,0 +1,80 @@
+name: Windows System Network Config Discovery Display DNS
+id: e24f0a0e-41a9-419f-9999-eacab15efc36
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies a process command line that retrieves dns reply information using Windows OS built-in tool IPConfig. 
+  This technique is being abused by threat actors, adversaries and post exploitation tools like WINPEAS to retrieve DNS information for the targeted host. 
+  This IPConfig parameter (/displaydns) can show dns server resource record, record name, record type, time to live data length and dns reply.
+  This hunting detection can be a good pivot to check which process is executing this command line in specific host system that may lead to malware or adversaries 
+  gathering network information.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name="ipconfig.exe" OR Processes.original_file_name = "ipconfig.exe" AND Processes.process = "*/displaydns*"
+  by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid 
+  Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_system_network_config_discovery_display_dns_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: unknown
+references:
+- https://superuser.com/questions/230308/explain-output-of-ipconfig-displaydns
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: process $process_name$ with commandline $process$ is executed in $dest$
+  mitre_attack_id:
+  - T1016
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.parent_process_guid 
+  - Processes.process_guid 
+  risk_score: 9
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
new file mode 100644
index 0000000000..9ccf342f72
--- /dev/null
+++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
@@ -0,0 +1,80 @@
+name: Windows System Network Connections Discovery Netsh
+id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: AnomHuntingaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a process execution of Windows OS built-in tool netsh.exe to show state, configuration and profile of host firewall. 
+  This tool is being used or abused by several adversaries or even post exploitation tool to bypass firewall rules or to discover firewall settings. 
+  This hunting detection can help to detect a possible suspicious usage of netsh.exe to retrieve firewall settings or even firewall wlan profile. 
+  We recommend checking which parent process and process name execute this command. Also check the process file path for verification that may lead to further 
+  TTP's threat behavior.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where `process_netsh`AND Processes.process = "* show *" Processes.process IN ("*state*", "*config*", "*wlan*", "*profile*")
+  by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid 
+  Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_system_network_connections_discovery_netsh_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: network administrator can use this tool for auditing process.
+references:
+- https://attack.mitre.org/techniques/T1049/
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: netsh process with command line $process$ in $dest$
+  mitre_attack_id:
+  - T1049
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.parent_process_guid 
+  - Processes.process_guid 
+  risk_score: 9
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_steal_or_forge_kerberos_tickets_klist.test.yml b/tests/endpoint/windows_steal_or_forge_kerberos_tickets_klist.test.yml
new file mode 100644
index 0000000000..8a4225c973
--- /dev/null
+++ b/tests/endpoint/windows_steal_or_forge_kerberos_tickets_klist.test.yml
@@ -0,0 +1,13 @@
+name: Windows Steal or Forge Kerberos Tickets Klist Unit Test
+tests:
+- name: Windows Steal or Forge Kerberos Tickets Klist
+  file: endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_system_network_config_discovery_display_dns.test.yml b/tests/endpoint/windows_system_network_config_discovery_display_dns.test.yml
new file mode 100644
index 0000000000..0958429d27
--- /dev/null
+++ b/tests/endpoint/windows_system_network_config_discovery_display_dns.test.yml
@@ -0,0 +1,13 @@
+name: Windows System Network Config Discovery Display DNS Unit Test
+tests:
+- name: Windows System Network Config Discovery Display DNS
+  file: endpoint/windows_system_network_config_discovery_display_dns.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_system_network_connections_discovery_netsh.test.yml b/tests/endpoint/windows_system_network_connections_discovery_netsh.test.yml
new file mode 100644
index 0000000000..5c04b66897
--- /dev/null
+++ b/tests/endpoint/windows_system_network_connections_discovery_netsh.test.yml
@@ -0,0 +1,13 @@
+name: Windows System Network Connections Discovery Netsh Unit Test
+tests:
+- name: Windows System Network Connections Discovery Netsh
+  file: endpoint/windows_system_network_connections_discovery_netsh.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 567697521bcf1306ae1cd867511012962db76e14 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 12 Dec 2022 11:22:58 +0100
Subject: [PATCH 11/12] Update
 windows_system_network_connections_discovery_netsh.yml

---
 .../windows_system_network_connections_discovery_netsh.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
index 9ccf342f72..adf6873a8b 100644
--- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
+++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
@@ -3,7 +3,7 @@ id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca
 version: 1
 date: '2022-11-30'
 author: Teoderick Contreras, Splunk
-type: AnomHuntingaly
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic identifies a process execution of Windows OS built-in tool netsh.exe to show state, configuration and profile of host firewall. 

From 5f9bf82ef3aeea4f3bd6472e364debdc23c04a81 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Tue, 13 Dec 2022 12:06:06 -0800
Subject: [PATCH 12/12] Update windows_private_keys_discovery.yml

---
 detections/endpoint/windows_private_keys_discovery.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_private_keys_discovery.yml b/detections/endpoint/windows_private_keys_discovery.yml
index 9bb86d7736..7f1869249c 100644
--- a/detections/endpoint/windows_private_keys_discovery.yml
+++ b/detections/endpoint/windows_private_keys_discovery.yml
@@ -44,7 +44,7 @@ tags:
   - Stage:Discovery
   - Stage:Recon
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon.log
   impact: 50
   kill_chain_phases:
   - Exploitation