updating docs and package bits [ci skip]

Author: research bot

detections/deprecated/detection_of_dns_tunnels.yml

@@ -6,20 +6,18 @@ author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Network_Resolution
-description: This search is used to detect DNS tunneling, by calculating the sum of
-  the length of DNS queries and DNS answers. The search also filters out potential
+description: 'This search is used to detect DNS tunneling, by calculating the sum
+  of the length of DNS queries and DNS answers. The search also filters out potential
   false positives by filtering out queries made to internal systems and the queries
   originating from internal DNS, Web, and Email servers. Endpoints using DNS as a
   method of transmission for data exfiltration, command and control, or evasion of
   security controls can often be detected by noting an unusually large volume of DNS
   traffic. \
 
-  NOTE:Deprecated because existing detection is doing the same. This detection is 
-  replaced with two other variations, if you are using MLTK then you can use this 
-  search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard 
-  deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, 
-  as an alternantive.   
-   
+  NOTE:Deprecated because existing detection is doing the same. This detection is
+  replaced with two other variations, if you are using MLTK then you can use this
+  search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation
+  version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.'
 search: '| tstats `security_content_summariesonly` dc("DNS.query") as count  from
   datamodel=Network_Resolution  where nodename=DNS "DNS.message_type"="QUERY" NOT
   (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa"

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml

@@ -15,10 +15,10 @@ description: Certutil.exe may download a file from a remote destination using `-
   remote IP or domain in question.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache*
-  Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.original_file_name
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
+  Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,

detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml

@@ -15,10 +15,10 @@ description: 'Certutil.exe may download a file from a remote destination using `
   written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl*
-  Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user Processes.original_file_name
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
+  Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user
+  Processes.original_file_name Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -20,8 +20,12 @@ description: 'The following analytic identifies the use of the EncodedCommand Po
   on admin scripts in use. \
 
   Alternatively, may use regex per matching here https://regexr.com/662ov.'
-search: 
-  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
+search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
+  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
+  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
+  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
+  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
+  |\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,

detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml

@@ -15,8 +15,12 @@ description: The following hunting analytic identifies PowerShell commands utili
   For example w, win, windowsty and so forth. In addition, through our research it
   was identified that PowerShell will interpret different command switch types beyond
   the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-search: 
-  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
+search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
+  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
+  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
+  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
+  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
+  |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.

detections/endpoint/rundll_loading_dll_by_ordinal.yml

@@ -6,24 +6,29 @@ author: Michael Haag, David Dorsey, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may
-  abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice
-  executing directly, may avoid triggering security tools that may not monitor execution
-  of the rundll32.exe process because of allowlists or false positives from normal
-  operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
+description: The following analytic identifies rundll32.exe loading an export function
+  by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious
+  code. Using rundll32.exe, vice executing directly, may avoid triggering security
+  tools that may not monitor execution of the rundll32.exe process because of allowlists
+  or false positives from normal operations. Utilizing ordinal values makes it a bit
+  more complicated for analysts to understand the behavior until the DLL is reviewed.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-    Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") | `rundll_loading_dll_by_ordinal_filter`'
+  where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") |
+  `rundll_loading_dll_by_ordinal_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
+known_false_positives: False positives are possible with native utilities and third
+  party applications. Filtering may be needed based on command-line, or add world
+  writeable paths to restrict query.
 references:
-  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ 
+- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 tags:
   analytic_story:
   - Unusual Processes

detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml

@@ -15,17 +15,21 @@ description: The following hunting analytic identifies PowerShell commands utili
   For example w, win, windowsty and so forth. In addition, through our research it
   was identified that PowerShell will interpret different command switch types beyond
   the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-search: '| from read_ssa_enriched_events()
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
-| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe"
-| where match_regex(cmd_line, /(?i)[\\-|\\/|\u2013\|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true 
-| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
-| into write_ssa_detected_events();'
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(cmd_line,
+  /(?i)[\\-|\\/|\u2013\|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval
+  start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
@@ -58,7 +62,8 @@ tags:
   kill_chain_phases:
   - Exfiltration
   message: PowerShell processes $process$ started with parameters to modify the execution
-    policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$.
+    policy of the run, run in a hidden window, and connect to the Internet on host
+    $dest$ executed by user $user$.
   mitre_attack_id:
   - T1020
   nist:

detections/endpoint/ssa___windows_powershell_downloadfile.yml

@@ -11,17 +11,20 @@ description: The following analytic identifies the use of PowerShell downloading
   PowerShell frameworks to download files and output to disk. Identify the source
   (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
   transaction logs are available, review for further details of the implant.
-search: '| from read_ssa_enriched_events()
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
-| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe"
-| where (like (cmd_line, "%downloadfile%"))
-| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
-| into write_ssa_detected_events();'
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
+  (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -50,7 +53,9 @@ tags:
   impact: 50
   kill_chain_phases:
   - Lateral Movement
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile
+    within PowerShell.
   mitre_attack_id:
   - T1020
   nist: