From 0eba4877ffc44275e518a47832513ad145da250e Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 15 Jan 2021 14:25:25 -0700
Subject: [PATCH 01/65] T1127.001 MSbuild

MSbuild detections and test.
---
 .../endpoint/suspicious_msbuild_netconn.yml   | 38 ++++++++++++++++
 .../endpoint/suspicious_msbuild_path.yml      | 42 ++++++++++++++++++
 .../endpoint/suspicious_msbuild_rename.yml    | 40 +++++++++++++++++
 .../endpoint/suspicious_msbuild_spawn.yml     | 44 +++++++++++++++++++
 .../suspicious_msbuild_netconn.test.yml       | 12 +++++
 .../endpoint/suspicious_msbuild_path.test.yml | 12 +++++
 .../suspicious_msbuild_rename.test.yml        | 12 +++++
 .../suspicious_msbuild_spawn.test.yml         | 12 +++++
 8 files changed, 212 insertions(+)
 create mode 100644 detections/endpoint/suspicious_msbuild_netconn.yml
 create mode 100644 detections/endpoint/suspicious_msbuild_path.yml
 create mode 100644 detections/endpoint/suspicious_msbuild_rename.yml
 create mode 100644 detections/endpoint/suspicious_msbuild_spawn.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_netconn.test.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_path.test.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_rename.test.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_spawn.test.yml

diff --git a/detections/endpoint/suspicious_msbuild_netconn.yml b/detections/endpoint/suspicious_msbuild_netconn.yml
new file mode 100644
index 0000000000..72e81409d4
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_netconn.yml
@@ -0,0 +1,38 @@
+name: Suspicious msbuild network connection
+id: 1e7e7df4-5522-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies instances of msbuild.exe performing a network connection.
+Review the code executed for suspicious behavior. The IP and domain should also be analyzed to determine
+legitimacy. 
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=3 process_name=msbuild.exe
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, process_path, DestinationHostname, DestinationIp
+| rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `suspicious_msbuild_netconn_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+ copy of msbuild, triggering a false positive.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
new file mode 100644
index 0000000000..e1612d0f1e
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -0,0 +1,42 @@
+name: Suspicious msbuild path
+id: f5198224-551c-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies msbuild.exe executing from a non-standard path. 
+Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
+C:\Windows\Microsoft.NET\Framework64\v4.0.30319. A moved instance of MSBuild is suspicious,
+however there are instances of build applications that will move or use a copy of MSBuild.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes
+  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe
+  AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v4.0.30319\\*)
+  by Processes.dest Processes.parent_process
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
+known_false_positives: Some legitimate applications may use a moved copy of msbuild,
+ triggering a false positive. Baselining of MSBuild usage is recommended to better
+ understand it's path usage.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001, T1036.003
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
new file mode 100644
index 0000000000..bc23e61ba5
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -0,0 +1,40 @@
+name: Suspicious msbuild rename
+id: 1e7e7df4-5522-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies renamed instances of msbuild.exe executing. 
+Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
+C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the
+code executed and what is executing a renamed instance of MSBuild.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+- https://github.com/infosecn1nja/MaliciousMacroMSBuild/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
+| rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `suspicious_msbuild_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+ copy of msbuild, triggering a false positive.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001, T1036.003
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
new file mode 100644
index 0000000000..24c5e48835
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -0,0 +1,44 @@
+name: Suspicious msbuild spawn
+id: a115fba6-5514-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. This
+behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe.
+It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In
+this instance, there will be command line arguments and file paths. In a malicious instance,
+MSBuild.exe will spawn from non-standard processes and have no command line arguments. For
+example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should
+be investigated.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes
+  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe
+  AND Processes.process_name=msbuild.exe
+  by Processes.dest Processes.parent_process
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_msbuild_netconn.test.yml b/tests/endpoint/suspicious_msbuild_netconn.test.yml
new file mode 100644
index 0000000000..00d09806fd
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_netconn.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild netconn
+tests:
+- name: Detect msbuild making external connection
+  file: endpoint/suspicious_msbuild_netconn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_path.test.yml b/tests/endpoint/suspicious_msbuild_path.test.yml
new file mode 100644
index 0000000000..605f4e8b9f
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_path.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild path
+tests:
+- name: Detect moved msbuild execution
+  file: endpoint/suspicious_msbuild_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_rename.test.yml b/tests/endpoint/suspicious_msbuild_rename.test.yml
new file mode 100644
index 0000000000..93e778725b
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_rename.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild rename
+tests:
+- name: Detect renamed msbuild execution
+  file: endpoint/suspicious_msbuild_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_spawn.test.yml b/tests/endpoint/suspicious_msbuild_spawn.test.yml
new file mode 100644
index 0000000000..a3926ab55e
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_spawn.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild spawn
+tests:
+- name: Detect wmiprvse spawn msbuild
+  file: endpoint/suspicious_msbuild_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From e27ad1399a492252c972257e11be9262818f62cc Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 15 Jan 2021 15:06:15 -0700
Subject: [PATCH 02/65] Revert "T1127.001 MSbuild"

This reverts commit 0eba4877ffc44275e518a47832513ad145da250e.
---
 .../endpoint/suspicious_msbuild_netconn.yml   | 38 ----------------
 .../endpoint/suspicious_msbuild_path.yml      | 42 ------------------
 .../endpoint/suspicious_msbuild_rename.yml    | 40 -----------------
 .../endpoint/suspicious_msbuild_spawn.yml     | 44 -------------------
 .../suspicious_msbuild_netconn.test.yml       | 12 -----
 .../endpoint/suspicious_msbuild_path.test.yml | 12 -----
 .../suspicious_msbuild_rename.test.yml        | 12 -----
 .../suspicious_msbuild_spawn.test.yml         | 12 -----
 8 files changed, 212 deletions(-)
 delete mode 100644 detections/endpoint/suspicious_msbuild_netconn.yml
 delete mode 100644 detections/endpoint/suspicious_msbuild_path.yml
 delete mode 100644 detections/endpoint/suspicious_msbuild_rename.yml
 delete mode 100644 detections/endpoint/suspicious_msbuild_spawn.yml
 delete mode 100644 tests/endpoint/suspicious_msbuild_netconn.test.yml
 delete mode 100644 tests/endpoint/suspicious_msbuild_path.test.yml
 delete mode 100644 tests/endpoint/suspicious_msbuild_rename.test.yml
 delete mode 100644 tests/endpoint/suspicious_msbuild_spawn.test.yml

diff --git a/detections/endpoint/suspicious_msbuild_netconn.yml b/detections/endpoint/suspicious_msbuild_netconn.yml
deleted file mode 100644
index 72e81409d4..0000000000
--- a/detections/endpoint/suspicious_msbuild_netconn.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-name: Suspicious msbuild network connection
-id: 1e7e7df4-5522-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-12'
-description: The following analytic identifies instances of msbuild.exe performing a network connection.
-Review the code executed for suspicious behavior. The IP and domain should also be analyzed to determine
-legitimacy. 
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-type: ESCU
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
-author: Michael Haag, Splunk
-search: '`sysmon` EventID=3 process_name=msbuild.exe
-| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, process_path, DestinationHostname, DestinationIp
-| rename Computer as dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `suspicious_msbuild_netconn_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use a moved
- copy of msbuild, triggering a false positive.
-tags:
-  analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
-  mitre_attack_id:
-  - T1127.001
-  kill_chain_phases:
-  - Exploitation
-  cis20:
-  - CIS 8
-  nist:
-  - PR.PT
-  - DE.CM
-  security_domain: endpoint
-  asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
deleted file mode 100644
index e1612d0f1e..0000000000
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: Suspicious msbuild path
-id: f5198224-551c-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-12'
-description: The following analytic identifies msbuild.exe executing from a non-standard path. 
-Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
-C:\Windows\Microsoft.NET\Framework64\v4.0.30319. A moved instance of MSBuild is suspicious,
-however there are instances of build applications that will move or use a copy of MSBuild.
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes
-  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
-type: ESCU
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
-author: Michael Haag, Splunk
-search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
-  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe
-  AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v4.0.30319\\*)
-  by Processes.dest Processes.parent_process
-  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
-known_false_positives: Some legitimate applications may use a moved copy of msbuild,
- triggering a false positive. Baselining of MSBuild usage is recommended to better
- understand it's path usage.
-tags:
-  analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
-  mitre_attack_id:
-  - T1127.001, T1036.003
-  kill_chain_phases:
-  - Exploitation
-  cis20:
-  - CIS 8
-  nist:
-  - PR.PT
-  - DE.CM
-  security_domain: endpoint
-  asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
deleted file mode 100644
index bc23e61ba5..0000000000
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: Suspicious msbuild rename
-id: 1e7e7df4-5522-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-12'
-description: The following analytic identifies renamed instances of msbuild.exe executing. 
-Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
-C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the
-code executed and what is executing a renamed instance of MSBuild.
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-type: ESCU
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
-- https://github.com/infosecn1nja/MaliciousMacroMSBuild/
-author: Michael Haag, Splunk
-search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
-| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
-| rename Computer as dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `suspicious_msbuild_rename_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use a moved
- copy of msbuild, triggering a false positive.
-tags:
-  analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
-  mitre_attack_id:
-  - T1127.001, T1036.003
-  kill_chain_phases:
-  - Exploitation
-  cis20:
-  - CIS 8
-  nist:
-  - PR.PT
-  - DE.CM
-  security_domain: endpoint
-  asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
deleted file mode 100644
index 24c5e48835..0000000000
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-name: Suspicious msbuild spawn
-id: a115fba6-5514-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-12'
-description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. This
-behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe.
-It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In
-this instance, there will be command line arguments and file paths. In a malicious instance,
-MSBuild.exe will spawn from non-standard processes and have no command line arguments. For
-example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should
-be investigated.
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes
-  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
-type: ESCU
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
-author: Michael Haag, Splunk
-search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
-  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe
-  AND Processes.process_name=msbuild.exe
-  by Processes.dest Processes.parent_process
-  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`'
-known_false_positives: Although unlikely, some legitimate applications may exhibit
-  this behavior, triggering a false positive.
-tags:
-  analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
-  mitre_attack_id:
-  - T1127.001
-  kill_chain_phases:
-  - Exploitation
-  cis20:
-  - CIS 8
-  nist:
-  - PR.PT
-  - DE.CM
-  security_domain: endpoint
-  asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_msbuild_netconn.test.yml b/tests/endpoint/suspicious_msbuild_netconn.test.yml
deleted file mode 100644
index 00d09806fd..0000000000
--- a/tests/endpoint/suspicious_msbuild_netconn.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Suspicious msbuild netconn
-tests:
-- name: Detect msbuild making external connection
-  file: endpoint/suspicious_msbuild_netconn.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_path.test.yml b/tests/endpoint/suspicious_msbuild_path.test.yml
deleted file mode 100644
index 605f4e8b9f..0000000000
--- a/tests/endpoint/suspicious_msbuild_path.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Suspicious msbuild path
-tests:
-- name: Detect moved msbuild execution
-  file: endpoint/suspicious_msbuild_path.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_rename.test.yml b/tests/endpoint/suspicious_msbuild_rename.test.yml
deleted file mode 100644
index 93e778725b..0000000000
--- a/tests/endpoint/suspicious_msbuild_rename.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Suspicious msbuild rename
-tests:
-- name: Detect renamed msbuild execution
-  file: endpoint/suspicious_msbuild_rename.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_spawn.test.yml b/tests/endpoint/suspicious_msbuild_spawn.test.yml
deleted file mode 100644
index a3926ab55e..0000000000
--- a/tests/endpoint/suspicious_msbuild_spawn.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Suspicious msbuild spawn
-tests:
-- name: Detect wmiprvse spawn msbuild
-  file: endpoint/suspicious_msbuild_spawn.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

From 9617d4d9b3db0f7ec0a43cae3da298a42da9ceb5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 15 Jan 2021 15:06:53 -0700
Subject: [PATCH 03/65] Revert "Revert "T1127.001 MSbuild""

This reverts commit e27ad1399a492252c972257e11be9262818f62cc.
---
 .../endpoint/suspicious_msbuild_netconn.yml   | 38 ++++++++++++++++
 .../endpoint/suspicious_msbuild_path.yml      | 42 ++++++++++++++++++
 .../endpoint/suspicious_msbuild_rename.yml    | 40 +++++++++++++++++
 .../endpoint/suspicious_msbuild_spawn.yml     | 44 +++++++++++++++++++
 .../suspicious_msbuild_netconn.test.yml       | 12 +++++
 .../endpoint/suspicious_msbuild_path.test.yml | 12 +++++
 .../suspicious_msbuild_rename.test.yml        | 12 +++++
 .../suspicious_msbuild_spawn.test.yml         | 12 +++++
 8 files changed, 212 insertions(+)
 create mode 100644 detections/endpoint/suspicious_msbuild_netconn.yml
 create mode 100644 detections/endpoint/suspicious_msbuild_path.yml
 create mode 100644 detections/endpoint/suspicious_msbuild_rename.yml
 create mode 100644 detections/endpoint/suspicious_msbuild_spawn.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_netconn.test.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_path.test.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_rename.test.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_spawn.test.yml

diff --git a/detections/endpoint/suspicious_msbuild_netconn.yml b/detections/endpoint/suspicious_msbuild_netconn.yml
new file mode 100644
index 0000000000..72e81409d4
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_netconn.yml
@@ -0,0 +1,38 @@
+name: Suspicious msbuild network connection
+id: 1e7e7df4-5522-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies instances of msbuild.exe performing a network connection.
+Review the code executed for suspicious behavior. The IP and domain should also be analyzed to determine
+legitimacy. 
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=3 process_name=msbuild.exe
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, process_path, DestinationHostname, DestinationIp
+| rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `suspicious_msbuild_netconn_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+ copy of msbuild, triggering a false positive.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
new file mode 100644
index 0000000000..e1612d0f1e
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -0,0 +1,42 @@
+name: Suspicious msbuild path
+id: f5198224-551c-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies msbuild.exe executing from a non-standard path. 
+Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
+C:\Windows\Microsoft.NET\Framework64\v4.0.30319. A moved instance of MSBuild is suspicious,
+however there are instances of build applications that will move or use a copy of MSBuild.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes
+  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe
+  AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v4.0.30319\\*)
+  by Processes.dest Processes.parent_process
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
+known_false_positives: Some legitimate applications may use a moved copy of msbuild,
+ triggering a false positive. Baselining of MSBuild usage is recommended to better
+ understand it's path usage.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001, T1036.003
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
new file mode 100644
index 0000000000..bc23e61ba5
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -0,0 +1,40 @@
+name: Suspicious msbuild rename
+id: 1e7e7df4-5522-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies renamed instances of msbuild.exe executing. 
+Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
+C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the
+code executed and what is executing a renamed instance of MSBuild.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+- https://github.com/infosecn1nja/MaliciousMacroMSBuild/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
+| rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `suspicious_msbuild_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+ copy of msbuild, triggering a false positive.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001, T1036.003
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
new file mode 100644
index 0000000000..24c5e48835
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -0,0 +1,44 @@
+name: Suspicious msbuild spawn
+id: a115fba6-5514-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. This
+behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe.
+It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In
+this instance, there will be command line arguments and file paths. In a malicious instance,
+MSBuild.exe will spawn from non-standard processes and have no command line arguments. For
+example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should
+be investigated.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes
+  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe
+  AND Processes.process_name=msbuild.exe
+  by Processes.dest Processes.parent_process
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_msbuild_netconn.test.yml b/tests/endpoint/suspicious_msbuild_netconn.test.yml
new file mode 100644
index 0000000000..00d09806fd
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_netconn.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild netconn
+tests:
+- name: Detect msbuild making external connection
+  file: endpoint/suspicious_msbuild_netconn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_path.test.yml b/tests/endpoint/suspicious_msbuild_path.test.yml
new file mode 100644
index 0000000000..605f4e8b9f
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_path.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild path
+tests:
+- name: Detect moved msbuild execution
+  file: endpoint/suspicious_msbuild_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_rename.test.yml b/tests/endpoint/suspicious_msbuild_rename.test.yml
new file mode 100644
index 0000000000..93e778725b
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_rename.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild rename
+tests:
+- name: Detect renamed msbuild execution
+  file: endpoint/suspicious_msbuild_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_spawn.test.yml b/tests/endpoint/suspicious_msbuild_spawn.test.yml
new file mode 100644
index 0000000000..a3926ab55e
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_spawn.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild spawn
+tests:
+- name: Detect wmiprvse spawn msbuild
+  file: endpoint/suspicious_msbuild_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From fd5e4adfb187b87ad878d1ded83c1ff344ccf033 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Sun, 17 Jan 2021 19:37:58 -0700
Subject: [PATCH 04/65] Revert "Revert "Revert "T1127.001 MSbuild"""

This reverts commit 9617d4d9b3db0f7ec0a43cae3da298a42da9ceb5.
---
 .../endpoint/suspicious_msbuild_netconn.yml   | 38 ----------------
 .../endpoint/suspicious_msbuild_path.yml      | 42 ------------------
 .../endpoint/suspicious_msbuild_rename.yml    | 40 -----------------
 .../endpoint/suspicious_msbuild_spawn.yml     | 44 -------------------
 .../suspicious_msbuild_netconn.test.yml       | 12 -----
 .../endpoint/suspicious_msbuild_path.test.yml | 12 -----
 .../suspicious_msbuild_rename.test.yml        | 12 -----
 .../suspicious_msbuild_spawn.test.yml         | 12 -----
 8 files changed, 212 deletions(-)
 delete mode 100644 detections/endpoint/suspicious_msbuild_netconn.yml
 delete mode 100644 detections/endpoint/suspicious_msbuild_path.yml
 delete mode 100644 detections/endpoint/suspicious_msbuild_rename.yml
 delete mode 100644 detections/endpoint/suspicious_msbuild_spawn.yml
 delete mode 100644 tests/endpoint/suspicious_msbuild_netconn.test.yml
 delete mode 100644 tests/endpoint/suspicious_msbuild_path.test.yml
 delete mode 100644 tests/endpoint/suspicious_msbuild_rename.test.yml
 delete mode 100644 tests/endpoint/suspicious_msbuild_spawn.test.yml

diff --git a/detections/endpoint/suspicious_msbuild_netconn.yml b/detections/endpoint/suspicious_msbuild_netconn.yml
deleted file mode 100644
index 72e81409d4..0000000000
--- a/detections/endpoint/suspicious_msbuild_netconn.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-name: Suspicious msbuild network connection
-id: 1e7e7df4-5522-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-12'
-description: The following analytic identifies instances of msbuild.exe performing a network connection.
-Review the code executed for suspicious behavior. The IP and domain should also be analyzed to determine
-legitimacy. 
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-type: ESCU
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
-author: Michael Haag, Splunk
-search: '`sysmon` EventID=3 process_name=msbuild.exe
-| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, process_path, DestinationHostname, DestinationIp
-| rename Computer as dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `suspicious_msbuild_netconn_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use a moved
- copy of msbuild, triggering a false positive.
-tags:
-  analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
-  mitre_attack_id:
-  - T1127.001
-  kill_chain_phases:
-  - Exploitation
-  cis20:
-  - CIS 8
-  nist:
-  - PR.PT
-  - DE.CM
-  security_domain: endpoint
-  asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
deleted file mode 100644
index e1612d0f1e..0000000000
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: Suspicious msbuild path
-id: f5198224-551c-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-12'
-description: The following analytic identifies msbuild.exe executing from a non-standard path. 
-Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
-C:\Windows\Microsoft.NET\Framework64\v4.0.30319. A moved instance of MSBuild is suspicious,
-however there are instances of build applications that will move or use a copy of MSBuild.
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes
-  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
-type: ESCU
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
-author: Michael Haag, Splunk
-search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
-  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe
-  AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v4.0.30319\\*)
-  by Processes.dest Processes.parent_process
-  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
-known_false_positives: Some legitimate applications may use a moved copy of msbuild,
- triggering a false positive. Baselining of MSBuild usage is recommended to better
- understand it's path usage.
-tags:
-  analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
-  mitre_attack_id:
-  - T1127.001, T1036.003
-  kill_chain_phases:
-  - Exploitation
-  cis20:
-  - CIS 8
-  nist:
-  - PR.PT
-  - DE.CM
-  security_domain: endpoint
-  asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
deleted file mode 100644
index bc23e61ba5..0000000000
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: Suspicious msbuild rename
-id: 1e7e7df4-5522-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-12'
-description: The following analytic identifies renamed instances of msbuild.exe executing. 
-Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
-C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the
-code executed and what is executing a renamed instance of MSBuild.
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-type: ESCU
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
-- https://github.com/infosecn1nja/MaliciousMacroMSBuild/
-author: Michael Haag, Splunk
-search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
-| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
-| rename Computer as dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `suspicious_msbuild_rename_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use a moved
- copy of msbuild, triggering a false positive.
-tags:
-  analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
-  mitre_attack_id:
-  - T1127.001, T1036.003
-  kill_chain_phases:
-  - Exploitation
-  cis20:
-  - CIS 8
-  nist:
-  - PR.PT
-  - DE.CM
-  security_domain: endpoint
-  asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
deleted file mode 100644
index 24c5e48835..0000000000
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-name: Suspicious msbuild spawn
-id: a115fba6-5514-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-12'
-description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. This
-behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe.
-It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In
-this instance, there will be command line arguments and file paths. In a malicious instance,
-MSBuild.exe will spawn from non-standard processes and have no command line arguments. For
-example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should
-be investigated.
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes
-  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
-type: ESCU
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
-author: Michael Haag, Splunk
-search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
-  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe
-  AND Processes.process_name=msbuild.exe
-  by Processes.dest Processes.parent_process
-  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`'
-known_false_positives: Although unlikely, some legitimate applications may exhibit
-  this behavior, triggering a false positive.
-tags:
-  analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
-  mitre_attack_id:
-  - T1127.001
-  kill_chain_phases:
-  - Exploitation
-  cis20:
-  - CIS 8
-  nist:
-  - PR.PT
-  - DE.CM
-  security_domain: endpoint
-  asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_msbuild_netconn.test.yml b/tests/endpoint/suspicious_msbuild_netconn.test.yml
deleted file mode 100644
index 00d09806fd..0000000000
--- a/tests/endpoint/suspicious_msbuild_netconn.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Suspicious msbuild netconn
-tests:
-- name: Detect msbuild making external connection
-  file: endpoint/suspicious_msbuild_netconn.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_path.test.yml b/tests/endpoint/suspicious_msbuild_path.test.yml
deleted file mode 100644
index 605f4e8b9f..0000000000
--- a/tests/endpoint/suspicious_msbuild_path.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Suspicious msbuild path
-tests:
-- name: Detect moved msbuild execution
-  file: endpoint/suspicious_msbuild_path.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_rename.test.yml b/tests/endpoint/suspicious_msbuild_rename.test.yml
deleted file mode 100644
index 93e778725b..0000000000
--- a/tests/endpoint/suspicious_msbuild_rename.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Suspicious msbuild rename
-tests:
-- name: Detect renamed msbuild execution
-  file: endpoint/suspicious_msbuild_rename.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_spawn.test.yml b/tests/endpoint/suspicious_msbuild_spawn.test.yml
deleted file mode 100644
index a3926ab55e..0000000000
--- a/tests/endpoint/suspicious_msbuild_spawn.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Suspicious msbuild spawn
-tests:
-- name: Detect wmiprvse spawn msbuild
-  file: endpoint/suspicious_msbuild_spawn.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog

From 08488e067ea963e544857297aa201fe489a9f50b Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Sun, 17 Jan 2021 19:38:36 -0700
Subject: [PATCH 05/65] Revert "Revert "Revert "Revert "T1127.001 MSbuild""""

This reverts commit fd5e4adfb187b87ad878d1ded83c1ff344ccf033.
---
 .../endpoint/suspicious_msbuild_netconn.yml   | 38 ++++++++++++++++
 .../endpoint/suspicious_msbuild_path.yml      | 42 ++++++++++++++++++
 .../endpoint/suspicious_msbuild_rename.yml    | 40 +++++++++++++++++
 .../endpoint/suspicious_msbuild_spawn.yml     | 44 +++++++++++++++++++
 .../suspicious_msbuild_netconn.test.yml       | 12 +++++
 .../endpoint/suspicious_msbuild_path.test.yml | 12 +++++
 .../suspicious_msbuild_rename.test.yml        | 12 +++++
 .../suspicious_msbuild_spawn.test.yml         | 12 +++++
 8 files changed, 212 insertions(+)
 create mode 100644 detections/endpoint/suspicious_msbuild_netconn.yml
 create mode 100644 detections/endpoint/suspicious_msbuild_path.yml
 create mode 100644 detections/endpoint/suspicious_msbuild_rename.yml
 create mode 100644 detections/endpoint/suspicious_msbuild_spawn.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_netconn.test.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_path.test.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_rename.test.yml
 create mode 100644 tests/endpoint/suspicious_msbuild_spawn.test.yml

diff --git a/detections/endpoint/suspicious_msbuild_netconn.yml b/detections/endpoint/suspicious_msbuild_netconn.yml
new file mode 100644
index 0000000000..72e81409d4
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_netconn.yml
@@ -0,0 +1,38 @@
+name: Suspicious msbuild network connection
+id: 1e7e7df4-5522-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies instances of msbuild.exe performing a network connection.
+Review the code executed for suspicious behavior. The IP and domain should also be analyzed to determine
+legitimacy. 
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=3 process_name=msbuild.exe
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, process_path, DestinationHostname, DestinationIp
+| rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `suspicious_msbuild_netconn_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+ copy of msbuild, triggering a false positive.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
new file mode 100644
index 0000000000..e1612d0f1e
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -0,0 +1,42 @@
+name: Suspicious msbuild path
+id: f5198224-551c-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies msbuild.exe executing from a non-standard path. 
+Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
+C:\Windows\Microsoft.NET\Framework64\v4.0.30319. A moved instance of MSBuild is suspicious,
+however there are instances of build applications that will move or use a copy of MSBuild.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes
+  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe
+  AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v4.0.30319\\*)
+  by Processes.dest Processes.parent_process
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
+known_false_positives: Some legitimate applications may use a moved copy of msbuild,
+ triggering a false positive. Baselining of MSBuild usage is recommended to better
+ understand it's path usage.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001, T1036.003
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
new file mode 100644
index 0000000000..bc23e61ba5
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -0,0 +1,40 @@
+name: Suspicious msbuild rename
+id: 1e7e7df4-5522-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies renamed instances of msbuild.exe executing. 
+Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
+C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the
+code executed and what is executing a renamed instance of MSBuild.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+- https://github.com/infosecn1nja/MaliciousMacroMSBuild/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
+| rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `suspicious_msbuild_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+ copy of msbuild, triggering a false positive.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001, T1036.003
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
new file mode 100644
index 0000000000..24c5e48835
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -0,0 +1,44 @@
+name: Suspicious msbuild spawn
+id: a115fba6-5514-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. This
+behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe.
+It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In
+this instance, there will be command line arguments and file paths. In a malicious instance,
+MSBuild.exe will spawn from non-standard processes and have no command line arguments. For
+example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should
+be investigated.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes
+  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe
+  AND Processes.process_name=msbuild.exe
+  by Processes.dest Processes.parent_process
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  mitre_attack_id:
+  - T1127.001
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_msbuild_netconn.test.yml b/tests/endpoint/suspicious_msbuild_netconn.test.yml
new file mode 100644
index 0000000000..00d09806fd
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_netconn.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild netconn
+tests:
+- name: Detect msbuild making external connection
+  file: endpoint/suspicious_msbuild_netconn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_path.test.yml b/tests/endpoint/suspicious_msbuild_path.test.yml
new file mode 100644
index 0000000000..605f4e8b9f
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_path.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild path
+tests:
+- name: Detect moved msbuild execution
+  file: endpoint/suspicious_msbuild_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_rename.test.yml b/tests/endpoint/suspicious_msbuild_rename.test.yml
new file mode 100644
index 0000000000..93e778725b
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_rename.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild rename
+tests:
+- name: Detect renamed msbuild execution
+  file: endpoint/suspicious_msbuild_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_spawn.test.yml b/tests/endpoint/suspicious_msbuild_spawn.test.yml
new file mode 100644
index 0000000000..a3926ab55e
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_spawn.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious msbuild spawn
+tests:
+- name: Detect wmiprvse spawn msbuild
+  file: endpoint/suspicious_msbuild_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 2e9bd74689151f0dff27603348868b3a80caa789 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Sun, 17 Jan 2021 19:43:38 -0700
Subject: [PATCH 06/65] MSBuild

fixes
---
 detections/endpoint/suspicious_msbuild_netconn.yml |  4 ++--
 detections/endpoint/suspicious_msbuild_path.yml    |  6 +++---
 detections/endpoint/suspicious_msbuild_rename.yml  |  6 +++---
 detections/endpoint/suspicious_msbuild_spawn.yml   | 12 ++++++------
 4 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_netconn.yml b/detections/endpoint/suspicious_msbuild_netconn.yml
index 72e81409d4..85db038dd4 100644
--- a/detections/endpoint/suspicious_msbuild_netconn.yml
+++ b/detections/endpoint/suspicious_msbuild_netconn.yml
@@ -3,8 +3,8 @@ id: 1e7e7df4-5522-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
 description: The following analytic identifies instances of msbuild.exe performing a network connection.
-Review the code executed for suspicious behavior. The IP and domain should also be analyzed to determine
-legitimacy. 
+  Review the code executed for suspicious behavior. The IP and domain should also be analyzed to determine
+  legitimacy. 
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index e1612d0f1e..93ca84ad95 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -3,9 +3,9 @@ id: f5198224-551c-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
 description: The following analytic identifies msbuild.exe executing from a non-standard path. 
-Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
-C:\Windows\Microsoft.NET\Framework64\v4.0.30319. A moved instance of MSBuild is suspicious,
-however there are instances of build applications that will move or use a copy of MSBuild.
+  Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
+  C:\Windows\Microsoft.NET\Framework64\v4.0.30319. A moved instance of MSBuild is suspicious,
+  however there are instances of build applications that will move or use a copy of MSBuild.
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes
   from your endpoints into the `Endpoint` datamodel in the `Processes` node.
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index bc23e61ba5..6a706cfb2f 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -3,9 +3,9 @@ id: 1e7e7df4-5522-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
 description: The following analytic identifies renamed instances of msbuild.exe executing. 
-Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
-C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the
-code executed and what is executing a renamed instance of MSBuild.
+  Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
+  C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the
+  code executed and what is executing a renamed instance of MSBuild.
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
index 24c5e48835..a259208df4 100644
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -3,12 +3,12 @@ id: a115fba6-5514-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
 description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. This
-behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe.
-It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In
-this instance, there will be command line arguments and file paths. In a malicious instance,
-MSBuild.exe will spawn from non-standard processes and have no command line arguments. For
-example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should
-be investigated.
+  behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe.
+  It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In
+  this instance, there will be command line arguments and file paths. In a malicious instance,
+  MSBuild.exe will spawn from non-standard processes and have no command line arguments. For
+  example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should
+  be investigated.
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes
   from your endpoints into the `Endpoint` datamodel in the `Processes` node.

From 7414436df5c628949955210d698a14de521582c9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Sun, 17 Jan 2021 19:46:00 -0700
Subject: [PATCH 07/65] ID Collision

---
 detections/endpoint/suspicious_msbuild_rename.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 6a706cfb2f..956006960c 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -1,5 +1,5 @@
 name: Suspicious msbuild rename
-id: 1e7e7df4-5522-11eb-ae93-0242ac130002
+id: 4006adac-5937-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
 description: The following analytic identifies renamed instances of msbuild.exe executing. 

From bcf56faa51bb4d13a0e065eb4c7a83edaa32186f Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Sun, 17 Jan 2021 19:49:13 -0700
Subject: [PATCH 08/65] Update suspicious_msbuild_netconn.yml

---
 detections/endpoint/suspicious_msbuild_netconn.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_msbuild_netconn.yml b/detections/endpoint/suspicious_msbuild_netconn.yml
index 85db038dd4..0d1464a24c 100644
--- a/detections/endpoint/suspicious_msbuild_netconn.yml
+++ b/detections/endpoint/suspicious_msbuild_netconn.yml
@@ -1,4 +1,4 @@
-name: Suspicious msbuild network connection
+name: Suspicious msbuild netconn
 id: 1e7e7df4-5522-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'

From 28827c7fdb81fe22829552907e6f4fde6b94a060 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Sun, 17 Jan 2021 20:02:56 -0700
Subject: [PATCH 09/65] MSHTA

Modified inlne mshta execution with the `about` protocol handler.
Added new mshta.exe child process analytic
---
 ...ning_scripts_in_command_line_arguments.yml | 20 +++++----
 .../suspicious_mshta_child_process.yml        | 45 +++++++++++++++++++
 .../suspicious_mshta_child_process.test.yml   | 12 +++++
 3 files changed, 69 insertions(+), 8 deletions(-)
 create mode 100644 detections/endpoint/suspicious_mshta_child_process.yml
 create mode 100644 tests/endpoint/suspicious_mshta_child_process.test.yml

diff --git a/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml b/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
index 969b649917..0b3ef21224 100644
--- a/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
+++ b/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
@@ -1,25 +1,29 @@
 name: Detect mshta exe running scripts in command-line arguments
 id: b89919ed-fe5f-492c-b139-95dqb161039e
-version: 4
+version: 5
 date: '2020-11-09'
-description: This search looks for the execution of "mshta.exe" with command-line
-  arguments that launch a script. The search will return the first time and last time
-  these command-line arguments were used for these executions, as well as the target
-  system, the user, process "mshta.exe" and its parent process.
+description: The following analytic identifies "mshta.exe" execution with inline
+  protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
+  options when invoking HTA content directly on the command-line. The search will 
+  return the first time and last time these command-line arguments were used for 
+  these executions, as well as the target system, the user, process "mshta.exe" 
+  and its parent process.
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
 type: ESCU
-references: []
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
 author: Bhavin Patel, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
-  (Processes.process=*vbscript* OR Processes.process=*javascript*) by Processes.user
+  (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user
   Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search
-  (process=*vbscript* OR process=*javascript*) | `detect_mshta_exe_running_scripts_in_command_line_arguments_filter`'
+  (process=*vbscript* OR process=*javascript* OR process=*about*) | `detect_mshta_exe_running_scripts_in_command_line_arguments_filter`'
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 tags:
diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml
new file mode 100644
index 0000000000..b91fee35d2
--- /dev/null
+++ b/detections/endpoint/suspicious_mshta_child_process.yml
@@ -0,0 +1,45 @@
+name: Suspicious mshta child process
+id: 60023bb6-5500-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies child processes spawning from  "mshta.exe". 
+  The search will return the first time and last time these command-line arguments were 
+  used for these executions, as well as the target system, the user, parent process
+ "mshta.exe" and its child process.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=mshta.exe
+  AND (Processes.process_name=powershell.exe OR Processes.process_name=colorcpl.exe OR Processes.process_name=msbuild.exe 
+  OR Processes.process_name=microsoft.workflow.compiler.exe OR Processes.process_name=searchprotocolhost.exe
+  OR Processes.process_name=scrcons.exe OR Processes.process_name=cscript.exe
+  OR Processes.process_name=wscript.exe OR Processes.process_name=powershell.exe OR Processes.process_name=cmd.exe)
+  by Processes.dest Processes.parent_process
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_mshta_child_process_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_mshta_child_process.test.yml b/tests/endpoint/suspicious_mshta_child_process.test.yml
new file mode 100644
index 0000000000..b96c148a5d
--- /dev/null
+++ b/tests/endpoint/suspicious_mshta_child_process.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious mshta child process Unit Test
+tests:
+- name: Detect mshta exe running scripts in command-line arguments
+  file: endpoint/suspicious_mshta_child_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From dbf7e128af6ad7e891faa6672cd0d9cbccd10c94 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Sun, 17 Jan 2021 20:09:52 -0700
Subject: [PATCH 10/65] MSBuild Story

---
 ...oper_utilities_proxy_execution_msbuild.yml | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 stories/trusted_developer_utilities_proxy_execution_msbuild.yml

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
new file mode 100644
index 0000000000..6215b88bbc
--- /dev/null
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -0,0 +1,31 @@
+name: 'Trusted Developer Utilities Proxy Execution MSBuild'
+id: be3418e2-551b-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: Monitor and detect techniques used by attackers who leverage the msbuild.exe
+  process to execute malicious code.
+narrative: 'Adversaries may use MSBuild to proxy execution of code through a trusted 
+  Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform
+  used by Visual Studio and is native to Windows. It handles XML formatted project
+  files that define requirements for loading and building various platforms and configurations.\
+
+  The inline task capability of MSBuild that was introduced in .NET version 4 allows
+  for C# code to be inserted into an XML project file. MSBuild will compile and
+  execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is
+  used this way it can execute arbitrary code and bypass application control defenses
+  that are configured to allow MSBuild.exe execution. \
+
+  The searches in this story help you detect and investigate suspicious activity that
+  may indicate that an adversary is leveraging msbuild.exe to execute malicious code.'
+author: Michael Haag, Splunk
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1127/001/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+- https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+tags:
+  analytics_story: 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics
\ No newline at end of file

From 7d6017aa2b74aa845e6d06c86d1109f39fbd4f1a Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Sun, 17 Jan 2021 20:16:42 -0700
Subject: [PATCH 11/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 stories/trusted_developer_utilities_proxy_execution_msbuild.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index 6215b88bbc..427c99dbb0 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -1,4 +1,4 @@
-name: 'Trusted Developer Utilities Proxy Execution MSBuild'
+name: Trusted developer utilities proxy execution msbuild
 id: be3418e2-551b-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'

From c964e5274c56efc08d757e2cc216705e606d386d Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Sun, 17 Jan 2021 20:21:25 -0700
Subject: [PATCH 12/65] Msbuild Story name and analytics fix

---
 detections/endpoint/suspicious_msbuild_netconn.yml              | 2 +-
 detections/endpoint/suspicious_msbuild_path.yml                 | 2 +-
 detections/endpoint/suspicious_msbuild_rename.yml               | 2 +-
 detections/endpoint/suspicious_msbuild_spawn.yml                | 2 +-
 stories/trusted_developer_utilities_proxy_execution_msbuild.yml | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_netconn.yml b/detections/endpoint/suspicious_msbuild_netconn.yml
index 0d1464a24c..4db319b5a1 100644
--- a/detections/endpoint/suspicious_msbuild_netconn.yml
+++ b/detections/endpoint/suspicious_msbuild_netconn.yml
@@ -22,7 +22,7 @@ known_false_positives: Although unlikely, some legitimate applications may use a
  copy of msbuild, triggering a false positive.
 tags:
   analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  - 'Trusted developer utilities proxy execution msbuild'
   mitre_attack_id:
   - T1127.001
   kill_chain_phases:
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index 93ca84ad95..061bc794fc 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -26,7 +26,7 @@ known_false_positives: Some legitimate applications may use a moved copy of msbu
  understand it's path usage.
 tags:
   analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  - 'Trusted developer utilities proxy execution msbuild'
   mitre_attack_id:
   - T1127.001, T1036.003
   kill_chain_phases:
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 956006960c..104f81a388 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -24,7 +24,7 @@ known_false_positives: Although unlikely, some legitimate applications may use a
  copy of msbuild, triggering a false positive.
 tags:
   analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  - 'Trusted developer utilities proxy execution msbuild'
   mitre_attack_id:
   - T1127.001, T1036.003
   kill_chain_phases:
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
index a259208df4..775524c3de 100644
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -28,7 +28,7 @@ known_false_positives: Although unlikely, some legitimate applications may exhib
   this behavior, triggering a false positive.
 tags:
   analytics_story:
-  - 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  - 'Trusted developer utilities proxy execution msbuild'
   mitre_attack_id:
   - T1127.001
   kill_chain_phases:
diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index 427c99dbb0..ee318951c0 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -25,7 +25,7 @@ references:
 - https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1
 - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
 tags:
-  analytics_story: 'Trusted Developer Utilities Proxy Execution: MSBuild'
+  analytics_story: Trusted developer utilities proxy execution msbuild
   usecase: Advanced Threat Detection
   category:
   - Adversary Tactics
\ No newline at end of file

From 3fa5c378ccbfd110e940e8a43ab7f869e4ca6aa9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 19 Jan 2021 08:21:59 -0700
Subject: [PATCH 13/65] Timestamp

Trying to fix :)
---
 tests/endpoint/suspicious_msbuild_netconn.test.yml | 1 +
 tests/endpoint/suspicious_msbuild_path.test.yml    | 1 +
 tests/endpoint/suspicious_msbuild_rename.test.yml  | 1 +
 tests/endpoint/suspicious_msbuild_spawn.test.yml   | 1 +
 4 files changed, 4 insertions(+)

diff --git a/tests/endpoint/suspicious_msbuild_netconn.test.yml b/tests/endpoint/suspicious_msbuild_netconn.test.yml
index 00d09806fd..c0c55d9ca3 100644
--- a/tests/endpoint/suspicious_msbuild_netconn.test.yml
+++ b/tests/endpoint/suspicious_msbuild_netconn.test.yml
@@ -10,3 +10,4 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+    update_timestamp: True
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_msbuild_path.test.yml b/tests/endpoint/suspicious_msbuild_path.test.yml
index 605f4e8b9f..a4669e1cbf 100644
--- a/tests/endpoint/suspicious_msbuild_path.test.yml
+++ b/tests/endpoint/suspicious_msbuild_path.test.yml
@@ -10,3 +10,4 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+    update_timestamp: True
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_msbuild_rename.test.yml b/tests/endpoint/suspicious_msbuild_rename.test.yml
index 93e778725b..c7879cd7d0 100644
--- a/tests/endpoint/suspicious_msbuild_rename.test.yml
+++ b/tests/endpoint/suspicious_msbuild_rename.test.yml
@@ -10,3 +10,4 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+    update_timestamp: True
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_msbuild_spawn.test.yml b/tests/endpoint/suspicious_msbuild_spawn.test.yml
index a3926ab55e..a2c81055e2 100644
--- a/tests/endpoint/suspicious_msbuild_spawn.test.yml
+++ b/tests/endpoint/suspicious_msbuild_spawn.test.yml
@@ -10,3 +10,4 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+    update_timestamp: True
\ No newline at end of file

From cdb6d034c4b2cadd13bac56d526f65516ead0011 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 19 Jan 2021 12:23:00 -0700
Subject: [PATCH 14/65] Removing netconn

---
 .../endpoint/suspicious_msbuild_netconn.yml   | 38 -------------------
 .../suspicious_msbuild_netconn.test.yml       | 13 -------
 2 files changed, 51 deletions(-)
 delete mode 100644 detections/endpoint/suspicious_msbuild_netconn.yml
 delete mode 100644 tests/endpoint/suspicious_msbuild_netconn.test.yml

diff --git a/detections/endpoint/suspicious_msbuild_netconn.yml b/detections/endpoint/suspicious_msbuild_netconn.yml
deleted file mode 100644
index 4db319b5a1..0000000000
--- a/detections/endpoint/suspicious_msbuild_netconn.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-name: Suspicious msbuild netconn
-id: 1e7e7df4-5522-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-12'
-description: The following analytic identifies instances of msbuild.exe performing a network connection.
-  Review the code executed for suspicious behavior. The IP and domain should also be analyzed to determine
-  legitimacy. 
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-type: ESCU
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
-author: Michael Haag, Splunk
-search: '`sysmon` EventID=3 process_name=msbuild.exe
-| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, process_path, DestinationHostname, DestinationIp
-| rename Computer as dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `suspicious_msbuild_netconn_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use a moved
- copy of msbuild, triggering a false positive.
-tags:
-  analytics_story:
-  - 'Trusted developer utilities proxy execution msbuild'
-  mitre_attack_id:
-  - T1127.001
-  kill_chain_phases:
-  - Exploitation
-  cis20:
-  - CIS 8
-  nist:
-  - PR.PT
-  - DE.CM
-  security_domain: endpoint
-  asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_msbuild_netconn.test.yml b/tests/endpoint/suspicious_msbuild_netconn.test.yml
deleted file mode 100644
index c0c55d9ca3..0000000000
--- a/tests/endpoint/suspicious_msbuild_netconn.test.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-name: Suspicious msbuild netconn
-tests:
-- name: Detect msbuild making external connection
-  file: endpoint/suspicious_msbuild_netconn.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
-    update_timestamp: True
\ No newline at end of file

From 65b4f2827b945da03943aa3e4abb38d1733719a8 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 19 Jan 2021 13:19:38 -0700
Subject: [PATCH 15/65] Update suspicious_msbuild_rename.yml

---
 detections/endpoint/suspicious_msbuild_rename.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 104f81a388..507d8290f8 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -19,7 +19,7 @@ author: Michael Haag, Splunk
 search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
 | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
 | rename Computer as dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `suspicious_msbuild_rename_filter`'
+  `security_content_ctime(lastTime)`'
 known_false_positives: Although unlikely, some legitimate applications may use a moved
  copy of msbuild, triggering a false positive.
 tags:

From 420bc3fc625753190017049d99b4b4058dc9175a Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 19 Jan 2021 13:22:44 -0700
Subject: [PATCH 16/65] Update suspicious_msbuild_rename.yml

---
 detections/endpoint/suspicious_msbuild_rename.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 507d8290f8..104f81a388 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -19,7 +19,7 @@ author: Michael Haag, Splunk
 search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
 | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
 | rename Computer as dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`'
+  `security_content_ctime(lastTime)`| `suspicious_msbuild_rename_filter`'
 known_false_positives: Although unlikely, some legitimate applications may use a moved
  copy of msbuild, triggering a false positive.
 tags:

From 44a9d0bc8c79c4bb4310a7f0d3bc110cda39a20d Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 19 Jan 2021 13:43:37 -0700
Subject: [PATCH 17/65] URL Fixes

Fixing all the URLs
---
 detections/endpoint/suspicious_msbuild_path.yml        | 2 +-
 detections/endpoint/suspicious_msbuild_rename.yml      | 2 +-
 detections/endpoint/suspicious_msbuild_spawn.yml       | 2 +-
 detections/endpoint/suspicious_mshta_child_process.yml | 2 +-
 tests/endpoint/suspicious_msbuild_path.test.yml        | 2 +-
 tests/endpoint/suspicious_msbuild_rename.test.yml      | 2 +-
 tests/endpoint/suspicious_msbuild_spawn.test.yml       | 2 +-
 tests/endpoint/suspicious_mshta_child_process.test.yml | 2 +-
 8 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index 061bc794fc..0d1d22a749 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -39,4 +39,4 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 104f81a388..e010469c87 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -37,4 +37,4 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
index 775524c3de..5fa52d510e 100644
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -41,4 +41,4 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml
index b91fee35d2..87c504d4bf 100644
--- a/detections/endpoint/suspicious_mshta_child_process.yml
+++ b/detections/endpoint/suspicious_mshta_child_process.yml
@@ -42,4 +42,4 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_msbuild_path.test.yml b/tests/endpoint/suspicious_msbuild_path.test.yml
index a4669e1cbf..fa5e080c6b 100644
--- a/tests/endpoint/suspicious_msbuild_path.test.yml
+++ b/tests/endpoint/suspicious_msbuild_path.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
     update_timestamp: True
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_msbuild_rename.test.yml b/tests/endpoint/suspicious_msbuild_rename.test.yml
index c7879cd7d0..be713ce446 100644
--- a/tests/endpoint/suspicious_msbuild_rename.test.yml
+++ b/tests/endpoint/suspicious_msbuild_rename.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
     update_timestamp: True
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_msbuild_spawn.test.yml b/tests/endpoint/suspicious_msbuild_spawn.test.yml
index a2c81055e2..498fd7134d 100644
--- a/tests/endpoint/suspicious_msbuild_spawn.test.yml
+++ b/tests/endpoint/suspicious_msbuild_spawn.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
     update_timestamp: True
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_mshta_child_process.test.yml b/tests/endpoint/suspicious_mshta_child_process.test.yml
index b96c148a5d..859f1ca43b 100644
--- a/tests/endpoint/suspicious_mshta_child_process.test.yml
+++ b/tests/endpoint/suspicious_mshta_child_process.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

From ad1564ceb7cc98b142741451051805c5267bf739 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-206-252>
Date: Tue, 19 Jan 2021 21:01:30 +0000
Subject: [PATCH 18/65] Added detection testing service results inDetect
 wmiprvse spawn msbuild

---
 .../endpoint/suspicious_msbuild_spawn.yml     | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
index 5fa52d510e..c3b85e4059 100644
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -2,16 +2,16 @@ name: Suspicious msbuild spawn
 id: a115fba6-5514-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
-description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. This
-  behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe.
-  It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In
-  this instance, there will be command line arguments and file paths. In a malicious instance,
-  MSBuild.exe will spawn from non-standard processes and have no command line arguments. For
-  example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should
-  be investigated.
+description: The following analytic identifies wmiprvse.exe spawning msbuild.exe.
+  This behavior is indicative of a COM object being utilized to spawn msbuild from
+  wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using
+  Visual Studio. In this instance, there will be command line arguments and file paths.
+  In a malicious instance, MSBuild.exe will spawn from non-standard processes and
+  have no command line arguments. For example, MSBuild.exe spawning from explorer.exe,
+  powershell.exe is far less common and should be investigated.
 how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes
-  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
 type: ESCU
 references:
 - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
@@ -20,15 +20,14 @@ author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe
-  AND Processes.process_name=msbuild.exe
-  by Processes.dest Processes.parent_process
+  AND Processes.process_name=msbuild.exe by Processes.dest Processes.parent_process
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`'
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 tags:
   analytics_story:
-  - 'Trusted developer utilities proxy execution msbuild'
+  - Trusted developer utilities proxy execution msbuild
   mitre_attack_id:
   - T1127.001
   kill_chain_phases:
@@ -42,3 +41,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+  automated_detection_testing: passed

From f26d176b8c3a869dc1e9d2ef3053c02c6bf8cfc3 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-8-176>
Date: Tue, 19 Jan 2021 21:37:47 +0000
Subject: [PATCH 19/65] Added detection testing service results inDetect moved
 msbuild execution

---
 .../endpoint/suspicious_msbuild_path.yml      | 25 ++++++++++---------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index 0d1d22a749..9180681980 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -2,13 +2,14 @@ name: Suspicious msbuild path
 id: f5198224-551c-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
-description: The following analytic identifies msbuild.exe executing from a non-standard path. 
-  Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
-  C:\Windows\Microsoft.NET\Framework64\v4.0.30319. A moved instance of MSBuild is suspicious,
-  however there are instances of build applications that will move or use a copy of MSBuild.
+description: The following analytic identifies msbuild.exe executing from a non-standard
+  path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319
+  and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. A moved instance of MSBuild
+  is suspicious, however there are instances of build applications that will move
+  or use a copy of MSBuild.
 how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes
-  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
 type: ESCU
 references:
 - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
@@ -18,15 +19,14 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe
   AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v4.0.30319\\*)
-  by Processes.dest Processes.parent_process
-  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
+  by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
 known_false_positives: Some legitimate applications may use a moved copy of msbuild,
- triggering a false positive. Baselining of MSBuild usage is recommended to better
- understand it's path usage.
+  triggering a false positive. Baselining of MSBuild usage is recommended to better
+  understand it's path usage.
 tags:
   analytics_story:
-  - 'Trusted developer utilities proxy execution msbuild'
+  - Trusted developer utilities proxy execution msbuild
   mitre_attack_id:
   - T1127.001, T1036.003
   kill_chain_phases:
@@ -40,3 +40,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+  automated_detection_testing: passed

From b355147e2b423419bb1fa22f62995acff48dfcb7 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-8-176>
Date: Tue, 19 Jan 2021 21:42:57 +0000
Subject: [PATCH 20/65] Added detection testing service results inDetect
 renamed msbuild execution

---
 .../endpoint/suspicious_msbuild_rename.yml    | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index e010469c87..8fbfb125bb 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -2,10 +2,10 @@ name: Suspicious msbuild rename
 id: 4006adac-5937-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
-description: The following analytic identifies renamed instances of msbuild.exe executing. 
-  Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
-  C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the
-  code executed and what is executing a renamed instance of MSBuild.
+description: The following analytic identifies renamed instances of msbuild.exe executing.
+  Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and
+  C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
+  the code executed and what is executing a renamed instance of MSBuild.
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -17,14 +17,15 @@ references:
 - https://github.com/infosecn1nja/MaliciousMacroMSBuild/
 author: Michael Haag, Splunk
 search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
-| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
-| rename Computer as dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `suspicious_msbuild_rename_filter`'
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `suspicious_msbuild_rename_filter`'
 known_false_positives: Although unlikely, some legitimate applications may use a moved
- copy of msbuild, triggering a false positive.
+  copy of msbuild, triggering a false positive.
 tags:
   analytics_story:
-  - 'Trusted developer utilities proxy execution msbuild'
+  - Trusted developer utilities proxy execution msbuild
   mitre_attack_id:
   - T1127.001, T1036.003
   kill_chain_phases:
@@ -38,3 +39,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+  automated_detection_testing: passed

From d6a9bf502fef1e82d8160ffe7377a34a11de1f8b Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 19 Jan 2021 14:45:02 -0700
Subject: [PATCH 21/65] Microsoft Workflow Compiler

Adding analytics for microsoft.workflow.compiler.exe.
---
 ...ous_microsoft_workflow_compiler_rename.yml | 42 +++++++++++++++++++
 ...ious_microsoft_workflow_compiler_usage.yml | 41 ++++++++++++++++++
 ...ed_developer_utilities_proxy_execution.yml | 27 ++++++++++++
 ...icrosoft_workflow_compiler_rename.test.yml | 12 ++++++
 ...microsoft_workflow_compiler_usage.test.yml | 12 ++++++
 5 files changed, 134 insertions(+)
 create mode 100644 detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
 create mode 100644 detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
 create mode 100644 stories/trusted_developer_utilities_proxy_execution.yml
 create mode 100644 tests/endpoint/suspicious_microsoft_workflow_compiler_rename.test.yml
 create mode 100644 tests/endpoint/suspicious_microsoft_workflow_compiler_usage.test.yml

diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
new file mode 100644
index 0000000000..7f6a89b807
--- /dev/null
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -0,0 +1,42 @@
+name: Suspicious microsoft workflow compiler rename
+id: f0db4464-55d9-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies a renamed instance of 
+  microsoft.workflow.compiler.exe. Microsoft.workflow.compiler.exe is natively found in
+  C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. 
+  When investigating, identify the executed code on disk and review. A spawned child
+  process from microsoft.workflow.compiler.exe is uncommon. In any instance, 
+  microsoft.workflow.compiler.exe spawning from an Office product or any living off 
+  the land binary is highly suspect. 
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=microsoft.workflow.compiler.exe OR process_name=microsoft.workflow.compiler.exe)
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
+| rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `suspicious_microsoft_workflow_compiler_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+ copy of microsoft.workflow.compiler.exe, triggering a false positive.
+tags:
+  analytics_story:
+  - Trusted Developer Utilities Proxy Execution
+  mitre_attack_id:
+  - T1127, T1036.003
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
new file mode 100644
index 0000000000..544f947b72
--- /dev/null
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -0,0 +1,41 @@
+name: Suspicious microsoft workflow compiler usage
+id: 9bbc62e8-55d8-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies microsoft.workflow.compiler.exe usage.
+  microsoft.workflow.compiler.exe is natively found in
+  C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. 
+  When investigating, identify the executed code on disk and review. It is not a commonly
+  used process by many applications. 
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes
+  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=microsoft.workflow.compiler.exe 
+  by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`'
+known_false_positives: Although unlikely, limited instances have been identified coming from 
+  native Microsoft utilities similar to SCCM. 
+tags:
+  analytics_story:
+  - Trusted Developer Utilities Proxy Execution
+  mitre_attack_id:
+  - T1127
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
diff --git a/stories/trusted_developer_utilities_proxy_execution.yml b/stories/trusted_developer_utilities_proxy_execution.yml
new file mode 100644
index 0000000000..1ee0f8bda8
--- /dev/null
+++ b/stories/trusted_developer_utilities_proxy_execution.yml
@@ -0,0 +1,27 @@
+name: Trusted Developer Utilities Proxy Execution
+id: 270a67a6-55d8-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: Monitor and detect behaviors used by attackers who leverage trusted developer utilities
+to execute malicious code.
+narrative: 'Adversaries may take advantage of trusted developer utilities to proxy
+execution of malicious payloads. There are many utilities used for software development
+related tasks that can be used to execute code in various forms to assist in development,
+debugging, and reverse engineering. These utilities may often be signed with
+legitimate certificates that allow them to execute on a system and proxy execution of
+malicious code through a trusted process that effectively bypasses application control solutions.\
+
+The searches in this story help you detect and investigate suspicious activity that
+may indicate that an adversary is leveraging microsoft.workflow.compiler.exe to execute 
+malicious code.'
+author: Michael Haag, Splunk
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1127/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md
+- https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
+tags:
+  analytics_story: Trusted Developer Utilities Proxy Execution
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_microsoft_workflow_compiler_rename.test.yml b/tests/endpoint/suspicious_microsoft_workflow_compiler_rename.test.yml
new file mode 100644
index 0000000000..eecb9688ea
--- /dev/null
+++ b/tests/endpoint/suspicious_microsoft_workflow_compiler_rename.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious microsoft workflow compiler rename
+tests:
+- name: Detect microsoft.workflow.compiler.exe rename
+  file: endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_microsoft_workflow_compiler_usage.test.yml b/tests/endpoint/suspicious_microsoft_workflow_compiler_usage.test.yml
new file mode 100644
index 0000000000..6593f91cb4
--- /dev/null
+++ b/tests/endpoint/suspicious_microsoft_workflow_compiler_usage.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious microsoft workflow compiler usage
+tests:
+- name: Detect microsoft.workflow.compiler.exe usage
+  file: endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 9514ec2d501690b4edb216f33488526e270f69f4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 19 Jan 2021 14:48:31 -0700
Subject: [PATCH 22/65] Update trusted_developer_utilities_proxy_execution.yml

---
 ...ted_developer_utilities_proxy_execution.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution.yml b/stories/trusted_developer_utilities_proxy_execution.yml
index 1ee0f8bda8..9c9041e846 100644
--- a/stories/trusted_developer_utilities_proxy_execution.yml
+++ b/stories/trusted_developer_utilities_proxy_execution.yml
@@ -3,17 +3,17 @@ id: 270a67a6-55d8-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
 description: Monitor and detect behaviors used by attackers who leverage trusted developer utilities
-to execute malicious code.
+  to execute malicious code.
 narrative: 'Adversaries may take advantage of trusted developer utilities to proxy
-execution of malicious payloads. There are many utilities used for software development
-related tasks that can be used to execute code in various forms to assist in development,
-debugging, and reverse engineering. These utilities may often be signed with
-legitimate certificates that allow them to execute on a system and proxy execution of
-malicious code through a trusted process that effectively bypasses application control solutions.\
+  execution of malicious payloads. There are many utilities used for software development
+  related tasks that can be used to execute code in various forms to assist in development,
+  debugging, and reverse engineering. These utilities may often be signed with
+  legitimate certificates that allow them to execute on a system and proxy execution of
+  malicious code through a trusted process that effectively bypasses application control solutions.\
 
-The searches in this story help you detect and investigate suspicious activity that
-may indicate that an adversary is leveraging microsoft.workflow.compiler.exe to execute 
-malicious code.'
+  The searches in this story help you detect and investigate suspicious activity that
+  may indicate that an adversary is leveraging microsoft.workflow.compiler.exe to execute 
+  malicious code.'
 author: Michael Haag, Splunk
 type: ESCU
 references:

From 5a22ce57f6b064a46bb0a430f797278a37edc196 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-25-143>
Date: Tue, 19 Jan 2021 22:11:46 +0000
Subject: [PATCH 23/65] Added detection testing service results inDetect
 microsoft.workflow.compiler.exe rename

---
 ...ous_microsoft_workflow_compiler_rename.yml | 23 ++++++++++---------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
index 7f6a89b807..6ec574c916 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -2,13 +2,12 @@ name: Suspicious microsoft workflow compiler rename
 id: f0db4464-55d9-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
-description: The following analytic identifies a renamed instance of 
-  microsoft.workflow.compiler.exe. Microsoft.workflow.compiler.exe is natively found in
-  C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. 
-  When investigating, identify the executed code on disk and review. A spawned child
-  process from microsoft.workflow.compiler.exe is uncommon. In any instance, 
-  microsoft.workflow.compiler.exe spawning from an Office product or any living off 
-  the land binary is highly suspect. 
+description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe.
+  Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
+  and is rarely utilized. When investigating, identify the executed code on disk and
+  review. A spawned child process from microsoft.workflow.compiler.exe is uncommon.
+  In any instance, microsoft.workflow.compiler.exe spawning from an Office product
+  or any living off the land binary is highly suspect.
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -19,11 +18,12 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
 author: Michael Haag, Splunk
 search: '`sysmon` EventID=1 (OriginalFileName=microsoft.workflow.compiler.exe OR process_name=microsoft.workflow.compiler.exe)
-| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
-| rename Computer as dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `suspicious_microsoft_workflow_compiler_rename_filter`'
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `suspicious_microsoft_workflow_compiler_rename_filter`'
 known_false_positives: Although unlikely, some legitimate applications may use a moved
- copy of microsoft.workflow.compiler.exe, triggering a false positive.
+  copy of microsoft.workflow.compiler.exe, triggering a false positive.
 tags:
   analytics_story:
   - Trusted Developer Utilities Proxy Execution
@@ -40,3 +40,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+  automated_detection_testing: passed

From edd77b709fe74bfd3a11b31398cc9e0f1ed0ae09 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-25-143>
Date: Tue, 19 Jan 2021 22:12:26 +0000
Subject: [PATCH 24/65] Added detection testing service results inDetect
 microsoft.workflow.compiler.exe usage

---
 ...ious_microsoft_workflow_compiler_usage.yml | 21 +++++++++----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
index 544f947b72..6aa74baac1 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -3,13 +3,12 @@ id: 9bbc62e8-55d8-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
 description: The following analytic identifies microsoft.workflow.compiler.exe usage.
-  microsoft.workflow.compiler.exe is natively found in
-  C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. 
-  When investigating, identify the executed code on disk and review. It is not a commonly
-  used process by many applications. 
+  microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
+  and is rarely utilized. When investigating, identify the executed code on disk and
+  review. It is not a commonly used process by many applications.
 how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes
-  from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
 type: ESCU
 references:
 - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
@@ -17,12 +16,11 @@ references:
 author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=microsoft.workflow.compiler.exe 
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=microsoft.workflow.compiler.exe
   by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`'
-known_false_positives: Although unlikely, limited instances have been identified coming from 
-  native Microsoft utilities similar to SCCM. 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`'
+known_false_positives: Although unlikely, limited instances have been identified coming
+  from native Microsoft utilities similar to SCCM.
 tags:
   analytics_story:
   - Trusted Developer Utilities Proxy Execution
@@ -39,3 +37,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+  automated_detection_testing: passed

From ed6e40433ccceaa08a9a89251749910a5eb8dff9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 10:48:25 -0700
Subject: [PATCH 25/65] rundll32 inline hta

Rundll32 inline hta execution
---
 ...ning_scripts_in_command_line_arguments.yml | 12 ++---
 .../detect_rundll32_inline_hta_execution.yml  | 45 +++++++++++++++++++
 ...ect_rundll32_inline_hta_execution.test.yml | 12 +++++
 3 files changed, 63 insertions(+), 6 deletions(-)
 create mode 100644 detections/endpoint/detect_rundll32_inline_hta_execution.yml
 create mode 100644 tests/endpoint/detect_rundll32_inline_hta_execution.test.yml

diff --git a/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml b/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
index 0b3ef21224..290592b503 100644
--- a/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
+++ b/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
@@ -1,22 +1,22 @@
 name: Detect mshta exe running scripts in command-line arguments
 id: b89919ed-fe5f-492c-b139-95dqb161039e
 version: 5
-date: '2020-11-09'
+date: '2021-01-20'
 description: The following analytic identifies "mshta.exe" execution with inline
   protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
   options when invoking HTA content directly on the command-line. The search will 
   return the first time and last time these command-line arguments were used for 
   these executions, as well as the target system, the user, process "mshta.exe" 
   and its parent process.
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
 type: ESCU
 references:
 - https://github.com/redcanaryco/AtomicTestHarnesses
 - https://redcanary.com/blog/introducing-atomictestharnesses/
-author: Bhavin Patel, Splunk
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+author: Bhavin Patel, Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
new file mode 100644
index 0000000000..310ae2bbc2
--- /dev/null
+++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
@@ -0,0 +1,45 @@
+name: Detect Rundll32 Inline HTA Execution
+id: 91c79f14-5b41-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: The following analytic identifies "rundll32.exe" execution with inline
+  protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
+  options when invoking HTA content directly on the command-line. This type of behavior is
+  commonly observed with fileless malware or application whitelisting bypass techniques.
+  The search will return the first time and last time these command-line arguments were used for 
+  these executions, as well as the target system, the user, process "rundll32.exe" 
+  and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user
+  Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search
+  (process=*vbscript* OR process=*javascript* OR process=*about*) | `detect_rundll32_inline_hta_execution_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/windows-sysmon.log
diff --git a/tests/endpoint/detect_rundll32_inline_hta_execution.test.yml b/tests/endpoint/detect_rundll32_inline_hta_execution.test.yml
new file mode 100644
index 0000000000..9db91e1c52
--- /dev/null
+++ b/tests/endpoint/detect_rundll32_inline_hta_execution.test.yml
@@ -0,0 +1,12 @@
+name: Detect rundll32 inline hta execution Test
+tests:
+- name: Detect rundll32 executing hta with inline protocols
+  file: endpoint/detect_rundll32_inline_hta_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 267b33b9b4077a026c863402623b6c06b627c1fd Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-103-74>
Date: Wed, 20 Jan 2021 18:13:10 +0000
Subject: [PATCH 26/65] Added detection testing service results inDetect
 rundll32 executing hta with inline protocols

---
 .../detect_rundll32_inline_hta_execution.yml  | 21 ++++++++++---------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
index 310ae2bbc2..3f060e26ac 100644
--- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml
+++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
@@ -4,11 +4,11 @@ version: 1
 date: '2021-01-20'
 description: The following analytic identifies "rundll32.exe" execution with inline
   protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
-  options when invoking HTA content directly on the command-line. This type of behavior is
-  commonly observed with fileless malware or application whitelisting bypass techniques.
-  The search will return the first time and last time these command-line arguments were used for 
-  these executions, as well as the target system, the user, process "rundll32.exe" 
-  and its parent process.
+  options when invoking HTA content directly on the command-line. This type of behavior
+  is commonly observed with fileless malware or application whitelisting bypass techniques.
+  The search will return the first time and last time these command-line arguments
+  were used for these executions, as well as the target system, the user, process
+  "rundll32.exe" and its parent process.
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -21,10 +21,10 @@ author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user
-  Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search
-  (process=*vbscript* OR process=*javascript* OR process=*about*) | `detect_rundll32_inline_hta_execution_filter`'
+  (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*)
+  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  search (process=*vbscript* OR process=*javascript* OR process=*about*) | `detect_rundll32_inline_hta_execution_filter`'
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 tags:
@@ -42,4 +42,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 4299138f979a69ddd37ca5787ceaf6372498d239 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 11:43:42 -0700
Subject: [PATCH 27/65] Update detect_rundll32_inline_hta_execution.yml

---
 detections/endpoint/detect_rundll32_inline_hta_execution.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
index 3f060e26ac..194a204078 100644
--- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml
+++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
@@ -23,8 +23,8 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
   (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*)
   by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
-  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  search (process=*vbscript* OR process=*javascript* OR process=*about*) | `detect_rundll32_inline_hta_execution_filter`'
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `detect_rundll32_inline_hta_execution_filter`'
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 tags:

From 1d1123051025b3127989da92be6dc269c9bcb862 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 12:00:25 -0700
Subject: [PATCH 28/65] MSHTA

Updated story
added mshta url in cmdline analytic
---
 .../detect_mshta_url_in_command_line.yml      | 46 +++++++++++++++++++
 stories/suspicious_mshta_activity.yml         |  9 ++--
 .../detect_mshta_url_in_command_line.test.yml | 12 +++++
 3 files changed, 63 insertions(+), 4 deletions(-)
 create mode 100644 detections/endpoint/detect_mshta_url_in_command_line.yml
 create mode 100644 tests/endpoint/detect_mshta_url_in_command_line.test.yml

diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
new file mode 100644
index 0000000000..681404acbf
--- /dev/null
+++ b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -0,0 +1,46 @@
+name: Detect MSHTA Url in Command Line
+id: 93706e4a-5b50-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
+  utility is used to make remote http connections. Adversaries may use mshta.exe
+  to proxy the download and execution of remote .hta files. 
+  The analytic identifies command line arguments of http and https being used. This
+  technique is commonly used by malicious software to bypass preventative controls.
+  The search will return the first time and last time these command-line arguments
+  were used for these executions, as well as the target system, the user, process
+  "rundll32.exe" and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
+  (Processes.process="*http://*" OR Processes.process="*https://*")
+  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `detect_mshta_url_in_command_line_filter`'
+known_false_positives: It is possible legitimate applications may perform
+  this behavior and will need to be filtered.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
diff --git a/stories/suspicious_mshta_activity.yml b/stories/suspicious_mshta_activity.yml
index 6c1a98a5a5..774def0f77 100644
--- a/stories/suspicious_mshta_activity.yml
+++ b/stories/suspicious_mshta_activity.yml
@@ -1,7 +1,7 @@
 name: Suspicious MSHTA Activity
 id: 2b1800dd-92f9-47dd-a981-fdf13w1q5d55
-version: 1
-date: '2020-02-03'
+version: 2
+date: '2021-01-20'
 description: Monitor and detect techniques used by attackers who leverage the mshta.exe
   process to execute malicious code.
 narrative: 'One common adversary tactic is to bypass application white-listing solutions
@@ -18,12 +18,13 @@ narrative: 'One common adversary tactic is to bypass application white-listing s
 
   The searches in this story help you detect and investigate suspicious activity that
   may indicate that an attacker is leveraging mshta.exe to execute malicious code.'
-author: Bhavin Patel, Splunk
+author: Bhavin Patel, Michael Haag, Splunk
 type: ESCU
 references:
+- https://redcanary.com/blog/introducing-atomictestharnesses/
 - https://redcanary.com/blog/windows-registry-attacks-threat-detection/
 - https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5
-- https://attack.mitre.org/wiki/Technique/T1170
+- https://attack.mitre.org/techniques/T1218/005/
 tags:
   analytics_story: Suspicious MSHTA Activity
   usecase: Advanced Threat Detection
diff --git a/tests/endpoint/detect_mshta_url_in_command_line.test.yml b/tests/endpoint/detect_mshta_url_in_command_line.test.yml
new file mode 100644
index 0000000000..82922a6f94
--- /dev/null
+++ b/tests/endpoint/detect_mshta_url_in_command_line.test.yml
@@ -0,0 +1,12 @@
+name: Detect mshta url in command line test
+tests:
+- name: Detect mshta url in command line
+  file: endpoint/detect_mshta_url_in_command_line.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From db1265ad84266685fd24ddaf1730336ddd3633be Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-237-154>
Date: Wed, 20 Jan 2021 19:24:25 +0000
Subject: [PATCH 29/65] Added detection testing service results inDetect mshta
 url in command line

---
 .../detect_mshta_url_in_command_line.yml      | 25 +++++++++----------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
index 681404acbf..8eee09f4e8 100644
--- a/detections/endpoint/detect_mshta_url_in_command_line.yml
+++ b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -3,13 +3,12 @@ id: 93706e4a-5b50-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-20'
 description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
-  utility is used to make remote http connections. Adversaries may use mshta.exe
-  to proxy the download and execution of remote .hta files. 
-  The analytic identifies command line arguments of http and https being used. This
-  technique is commonly used by malicious software to bypass preventative controls.
-  The search will return the first time and last time these command-line arguments
-  were used for these executions, as well as the target system, the user, process
-  "rundll32.exe" and its parent process.
+  utility is used to make remote http connections. Adversaries may use mshta.exe to
+  proxy the download and execution of remote .hta files. The analytic identifies command
+  line arguments of http and https being used. This technique is commonly used by
+  malicious software to bypass preventative controls. The search will return the first
+  time and last time these command-line arguments were used for these executions,
+  as well as the target system, the user, process "rundll32.exe" and its parent process.
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -22,12 +21,11 @@ author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
-  (Processes.process="*http://*" OR Processes.process="*https://*")
-  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
-  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `detect_mshta_url_in_command_line_filter`'
-known_false_positives: It is possible legitimate applications may perform
-  this behavior and will need to be filtered.
+  (Processes.process="*http://*" OR Processes.process="*https://*") by Processes.user
+  Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mshta_url_in_command_line_filter`'
+known_false_positives: It is possible legitimate applications may perform this behavior
+  and will need to be filtered.
 tags:
   analytics_story:
   - Suspicious MSHTA Activity
@@ -44,3 +42,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 5b0ff632789fde0ded649ff3c2f6471d7f8656b0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 12:44:21 -0700
Subject: [PATCH 30/65] rename mshta inline hta execution

---
 ..._arguments.yml => detect_mshta_inline_hta_execution.yml} | 6 +++---
 ...a_exe_running_scripts_in_command_line_arguments.test.yml | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)
 rename detections/endpoint/{detect_mshta_exe_running_scripts_in_command_line_arguments.yml => detect_mshta_inline_hta_execution.yml} (90%)

diff --git a/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
similarity index 90%
rename from detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
rename to detections/endpoint/detect_mshta_inline_hta_execution.yml
index 290592b503..77f89920b8 100644
--- a/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -1,4 +1,4 @@
-name: Detect mshta exe running scripts in command-line arguments
+name: Detect mshta inline hta execution
 id: b89919ed-fe5f-492c-b139-95dqb161039e
 version: 5
 date: '2021-01-20'
@@ -22,8 +22,8 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
   (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user
   Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search
-  (process=*vbscript* OR process=*javascript* OR process=*about*) | `detect_mshta_exe_running_scripts_in_command_line_arguments_filter`'
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` 
+  | `detect_mshta_mshta_inline_hta_execution_filter`'
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 tags:
diff --git a/tests/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml b/tests/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml
index ae75a6fcfd..3f7168eb70 100644
--- a/tests/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml
+++ b/tests/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml
@@ -1,7 +1,7 @@
-name: Detect mshta exe running scripts in command-line arguments Unit Test
+name: Detect mshta inline hta execution Unit Test
 tests:
-- name: Detect mshta exe running scripts in command-line arguments
-  file: endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
+- name: Detect mshta executing inline protocol handlers
+  file: endpoint/detect_mshta_inline_hta_execution.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From dfc9ac84c53f3a124fe5052f3eabcbcb058a86d4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 12:48:28 -0700
Subject: [PATCH 31/65] Update detect_mshta_inline_hta_execution.yml

---
 detections/endpoint/detect_mshta_inline_hta_execution.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
index 77f89920b8..4ffef00618 100644
--- a/detections/endpoint/detect_mshta_inline_hta_execution.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -1,4 +1,4 @@
-name: Detect mshta inline hta execution
+name: detect mshta inline hta execution
 id: b89919ed-fe5f-492c-b139-95dqb161039e
 version: 5
 date: '2021-01-20'

From 676a51159ed311b4dda1475ee64274ff3e58c19b Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 12:53:19 -0700
Subject: [PATCH 32/65] Update detect_mshta_inline_hta_execution.yml

---
 detections/endpoint/detect_mshta_inline_hta_execution.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
index 4ffef00618..77f89920b8 100644
--- a/detections/endpoint/detect_mshta_inline_hta_execution.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -1,4 +1,4 @@
-name: detect mshta inline hta execution
+name: Detect mshta inline hta execution
 id: b89919ed-fe5f-492c-b139-95dqb161039e
 version: 5
 date: '2021-01-20'

From 9205419f90debc671822ae3eb67ca498ca51d628 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 13:16:33 -0700
Subject: [PATCH 33/65] Update detect_mshta_inline_hta_execution.yml

---
 detections/endpoint/detect_mshta_inline_hta_execution.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
index 77f89920b8..9dc1daed98 100644
--- a/detections/endpoint/detect_mshta_inline_hta_execution.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -23,7 +23,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user
   Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` 
-  | `detect_mshta_mshta_inline_hta_execution_filter`'
+  | `detect_mshta_inline_hta_execution_filter`'
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 tags:

From c3197d003eccd039f8f2cfe1d9774cd0fc7697b7 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 13:50:57 -0700
Subject: [PATCH 34/65] mshta renamed

---
 detections/endpoint/detect_mshta_renamed.yml | 42 ++++++++++++++++++++
 tests/endpoint/detect_mshta_renamed.test.yml | 12 ++++++
 2 files changed, 54 insertions(+)
 create mode 100644 detections/endpoint/detect_mshta_renamed.yml
 create mode 100644 tests/endpoint/detect_mshta_renamed.test.yml

diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
new file mode 100644
index 0000000000..6e896a429d
--- /dev/null
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -0,0 +1,42 @@
+name: Detect mshta renamed
+id: 4006adac-5937-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: The following analytic identifies renamed instances of mshta.exe executing.
+  Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This
+  analytic utilizes the internal name of the PE to identify if is the legitimate
+  mshta binary. Further analysis should be performed to review the executed content 
+  and validation it is the real mshta. 
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=mshta.exe AND process_name!=mshta.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `detect_mshta_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of mshta.exe, but never renamed, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/tests/endpoint/detect_mshta_renamed.test.yml b/tests/endpoint/detect_mshta_renamed.test.yml
new file mode 100644
index 0000000000..7e6d69f00f
--- /dev/null
+++ b/tests/endpoint/detect_mshta_renamed.test.yml
@@ -0,0 +1,12 @@
+name: Detect mshta renamed unit test
+tests:
+- name: Detect mshta renamed
+  file: endpoint/detect_mshta_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 492c70d6ba647c07c3dcdf451d786db24f5c499f Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 13:54:17 -0700
Subject: [PATCH 35/65] Update detect_mshta_renamed.yml

---
 detections/endpoint/detect_mshta_renamed.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
index 6e896a429d..8ecb52029f 100644
--- a/detections/endpoint/detect_mshta_renamed.yml
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -1,5 +1,5 @@
 name: Detect mshta renamed
-id: 4006adac-5937-11eb-ae93-0242ac130002
+id: 9fd76376-5b61-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-20'
 description: The following analytic identifies renamed instances of mshta.exe executing.
@@ -20,7 +20,7 @@ search: '`sysmon` EventID=1 (OriginalFileName=mshta.exe AND process_name!=mshta.
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
   parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
   rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  `detect_mshta_rename_filter`'
+  `detect_mshta_renamed_filter`'
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of mshta.exe, but never renamed, triggering a false positive.
 tags:

From 03ac6e1174e8747ab68f2a1a0bfedf8fafee969c Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 14:16:29 -0700
Subject: [PATCH 36/65] Suspicious mshta spawn

Suspicious mshta spawn
---
 .../endpoint/suspicious_mshta_spawn.test.yml  | 12 ++++++
 .../endpoint/suspicious_mshta_spawn.yml       | 42 +++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 detections/endpoint/suspicious_mshta_spawn.test.yml
 create mode 100644 detections/endpoint/suspicious_mshta_spawn.yml

diff --git a/detections/endpoint/suspicious_mshta_spawn.test.yml b/detections/endpoint/suspicious_mshta_spawn.test.yml
new file mode 100644
index 0000000000..0acbd71f95
--- /dev/null
+++ b/detections/endpoint/suspicious_mshta_spawn.test.yml
@@ -0,0 +1,12 @@
+name: Detect mshta spawn unit test
+tests:
+- name: Detect mshta spawn
+  file: endpoint/suspicious_mshta_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml
new file mode 100644
index 0000000000..7060a3b0cf
--- /dev/null
+++ b/detections/endpoint/suspicious_mshta_spawn.yml
@@ -0,0 +1,42 @@
+name: Suspicious mshta spawn
+id: 4d33a488-5b5f-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: The following analytic identifies wmiprvse.exe spawning mshta.exe.
+  This behavior is indicative of a DCOM object being utilized to spawn mshta from
+  wmiprvse.exe or svchost.exe. In this instance, adversaries may use LethalHTA that will
+  spawn mshta.exe from svchost.exe.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://codewhitesec.blogspot.com/2018/07/lethalhta.html
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe
+  OR Processes.parent_process_name=wmiprvse.exe)
+  AND Processes.process_name=mshta.exe by Processes.dest Processes.parent_process
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_mshta_spawn_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/windows-sysmon.log
\ No newline at end of file

From f3d274c0f8c66c201f90fb8b599e7b29af5835a4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 14:45:27 -0700
Subject: [PATCH 37/65] ID changes

ID changes and a test file needed moved
---
 detections/endpoint/detect_mshta_inline_hta_execution.yml      | 2 +-
 detections/endpoint/detect_mshta_renamed.yml                   | 2 +-
 detections/endpoint/detect_mshta_url_in_command_line.yml       | 2 +-
 {detections => tests}/endpoint/suspicious_mshta_spawn.test.yml | 0
 4 files changed, 3 insertions(+), 3 deletions(-)
 rename {detections => tests}/endpoint/suspicious_mshta_spawn.test.yml (100%)

diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
index 9dc1daed98..414d02c1e3 100644
--- a/detections/endpoint/detect_mshta_inline_hta_execution.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -1,5 +1,5 @@
 name: Detect mshta inline hta execution
-id: b89919ed-fe5f-492c-b139-95dqb161039e
+id: a0873b32-5b68-11eb-ae93-0242ac130002
 version: 5
 date: '2021-01-20'
 description: The following analytic identifies "mshta.exe" execution with inline
diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
index 8ecb52029f..a2032afffb 100644
--- a/detections/endpoint/detect_mshta_renamed.yml
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -1,5 +1,5 @@
 name: Detect mshta renamed
-id: 9fd76376-5b61-11eb-ae93-0242ac130002
+id: 8f45fcf0-5b68-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-20'
 description: The following analytic identifies renamed instances of mshta.exe executing.
diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
index 8eee09f4e8..3a57d4fa7f 100644
--- a/detections/endpoint/detect_mshta_url_in_command_line.yml
+++ b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -1,5 +1,5 @@
 name: Detect MSHTA Url in Command Line
-id: 93706e4a-5b50-11eb-ae93-0242ac130002
+id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-20'
 description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
diff --git a/detections/endpoint/suspicious_mshta_spawn.test.yml b/tests/endpoint/suspicious_mshta_spawn.test.yml
similarity index 100%
rename from detections/endpoint/suspicious_mshta_spawn.test.yml
rename to tests/endpoint/suspicious_mshta_spawn.test.yml

From b60d75a58744d2200d3e40003e2d48f19ddb6fff Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 14:46:45 -0700
Subject: [PATCH 38/65] renamed testing

---
 detections/endpoint/detect_mshta_renamed.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
index a2032afffb..8a0442f6c9 100644
--- a/detections/endpoint/detect_mshta_renamed.yml
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -39,4 +39,3 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
-  automated_detection_testing: passed

From 6697920c8454aafa21354a8d44edcbdfa5faa13d Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-108-19>
Date: Wed, 20 Jan 2021 22:31:06 +0000
Subject: [PATCH 39/65] Added detection testing service results inDetect mshta
 spawn

---
 detections/endpoint/suspicious_mshta_spawn.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml
index 7060a3b0cf..334f896bd6 100644
--- a/detections/endpoint/suspicious_mshta_spawn.yml
+++ b/detections/endpoint/suspicious_mshta_spawn.yml
@@ -2,10 +2,10 @@ name: Suspicious mshta spawn
 id: 4d33a488-5b5f-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-20'
-description: The following analytic identifies wmiprvse.exe spawning mshta.exe.
-  This behavior is indicative of a DCOM object being utilized to spawn mshta from
-  wmiprvse.exe or svchost.exe. In this instance, adversaries may use LethalHTA that will
-  spawn mshta.exe from svchost.exe.
+description: The following analytic identifies wmiprvse.exe spawning mshta.exe. This
+  behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe
+  or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn
+  mshta.exe from svchost.exe.
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -18,10 +18,9 @@ author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe
-  OR Processes.parent_process_name=wmiprvse.exe)
-  AND Processes.process_name=mshta.exe by Processes.dest Processes.parent_process
-  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_mshta_spawn_filter`'
+  OR Processes.parent_process_name=wmiprvse.exe) AND Processes.process_name=mshta.exe
+  by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_mshta_spawn_filter`'
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 tags:
@@ -39,4 +38,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/windows-sysmon.log
\ No newline at end of file
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 802d15bed0c3f459b44db352e33c3f95320ac276 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 12:27:43 -0700
Subject: [PATCH 40/65] MSBuild story update

---
 .../endpoint/suspicious_msbuild_path.yml      |  2 +-
 .../endpoint/suspicious_msbuild_rename.yml    |  4 +-
 .../endpoint/suspicious_msbuild_spawn.yml     |  4 +-
 ...oper_utilities_proxy_execution_msbuild.yml | 37 +++++++++++++++++--
 4 files changed, 38 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index 9180681980..273ab01f36 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -26,7 +26,7 @@ known_false_positives: Some legitimate applications may use a moved copy of msbu
   understand it's path usage.
 tags:
   analytics_story:
-  - Trusted developer utilities proxy execution msbuild
+  - Trusted Developer Utilities Proxy Execution MSBuild
   mitre_attack_id:
   - T1127.001, T1036.003
   kill_chain_phases:
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 8fbfb125bb..124600c6ba 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -1,4 +1,4 @@
-name: Suspicious msbuild rename
+name: Suspicious MSBuild Rename
 id: 4006adac-5937-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
@@ -25,7 +25,7 @@ known_false_positives: Although unlikely, some legitimate applications may use a
   copy of msbuild, triggering a false positive.
 tags:
   analytics_story:
-  - Trusted developer utilities proxy execution msbuild
+  - Trusted Developer Utilities Proxy Execution MSBuild
   mitre_attack_id:
   - T1127.001, T1036.003
   kill_chain_phases:
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
index c3b85e4059..49a37d6b5a 100644
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -1,4 +1,4 @@
-name: Suspicious msbuild spawn
+name: Suspicious MSBuild Spawn
 id: a115fba6-5514-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
@@ -27,7 +27,7 @@ known_false_positives: Although unlikely, some legitimate applications may exhib
   this behavior, triggering a false positive.
 tags:
   analytics_story:
-  - Trusted developer utilities proxy execution msbuild
+  - Trusted Developer Utilities Proxy Execution MSBuild
   mitre_attack_id:
   - T1127.001
   kill_chain_phases:
diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index ee318951c0..41d3244521 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -1,7 +1,7 @@
-name: Trusted developer utilities proxy execution msbuild
+name: Trusted Developer Utilities Proxy Execution MSBuild
 id: be3418e2-551b-11eb-ae93-0242ac130002
 version: 1
-date: '2021-01-12'
+date: '2021-01-21'
 description: Monitor and detect techniques used by attackers who leverage the msbuild.exe
   process to execute malicious code.
 narrative: 'Adversaries may use MSBuild to proxy execution of code through a trusted 
@@ -16,16 +16,45 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
   that are configured to allow MSBuild.exe execution. \
 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an adversary is leveraging msbuild.exe to execute malicious code.'
+  may indicate that an adversary is leveraging msbuild.exe to execute malicious code.
+  
+  Default paths: c:\windows\microsoft.net\framework\v4.0.30319\, c:\windows\microsoft.net\framework64\v4.0.30319\
+  OriginalFileName: msbuild.exe
+  Module loads: microsoft.build.tasks.v4.0.dll OR microsoft.build.tasks.v4.0.ni.dll \
+  
+  Triage:\
+
+  Validate execution\
+
+  1. Determine if "MSBuild.exe" executed. Validate the OriginalFileName of "MSBuild.exe" and further
+  PE metadata.
+  2. Determine if script code was executed with MSBuild. \
+
+  Situational Awareness \
+
+  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by MSBuild.exe. 
+
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?
+  2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
+  MSbuild loading any suspicious .DLL's?
+  3. Network connections. Any network connections? Review the reputation of the remote IP/domain.
+  
+  Retrieval of script code \
+
+  Objective of this step is to confirm the executed script code is benign or malicious.'
+
 author: Michael Haag, Splunk
 type: ESCU
 references:
 - https://attack.mitre.org/techniques/T1127/001/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+- https://github.com/infosecn1nja/MaliciousMacroMSBuild
 - https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1
 - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md
 tags:
-  analytics_story: Trusted developer utilities proxy execution msbuild
+  analytics_story: Trusted Developer Utilities Proxy Execution MSBuild
   usecase: Advanced Threat Detection
   category:
   - Adversary Tactics
\ No newline at end of file

From 9dc0988a365f819517c3336ed51cd0624f50ca45 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 12:37:38 -0700
Subject: [PATCH 41/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 .../trusted_developer_utilities_proxy_execution_msbuild.yml  | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index 41d3244521..4dc176ca43 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -22,9 +22,9 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
   OriginalFileName: msbuild.exe
   Module loads: microsoft.build.tasks.v4.0.dll OR microsoft.build.tasks.v4.0.ni.dll \
   
-  Triage:\
+  Triage: \
 
-  Validate execution\
+  Validate execution \
 
   1. Determine if "MSBuild.exe" executed. Validate the OriginalFileName of "MSBuild.exe" and further
   PE metadata.
@@ -43,7 +43,6 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
   Retrieval of script code \
 
   Objective of this step is to confirm the executed script code is benign or malicious.'
-
 author: Michael Haag, Splunk
 type: ESCU
 references:

From 2e5c1bfa10b5a1f9f39b1767c34f2e6b4f4458f4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 12:41:06 -0700
Subject: [PATCH 42/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 ...veloper_utilities_proxy_execution_msbuild.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index 4dc176ca43..952b267859 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -7,30 +7,30 @@ description: Monitor and detect techniques used by attackers who leverage the ms
 narrative: 'Adversaries may use MSBuild to proxy execution of code through a trusted 
   Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform
   used by Visual Studio and is native to Windows. It handles XML formatted project
-  files that define requirements for loading and building various platforms and configurations.\
+  files that define requirements for loading and building various platforms and configurations.
 
   The inline task capability of MSBuild that was introduced in .NET version 4 allows
   for C# code to be inserted into an XML project file. MSBuild will compile and
   execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is
   used this way it can execute arbitrary code and bypass application control defenses
-  that are configured to allow MSBuild.exe execution. \
+  that are configured to allow MSBuild.exe execution.
 
   The searches in this story help you detect and investigate suspicious activity that
   may indicate that an adversary is leveraging msbuild.exe to execute malicious code.
   
   Default paths: c:\windows\microsoft.net\framework\v4.0.30319\, c:\windows\microsoft.net\framework64\v4.0.30319\
   OriginalFileName: msbuild.exe
-  Module loads: microsoft.build.tasks.v4.0.dll OR microsoft.build.tasks.v4.0.ni.dll \
+  Module loads: microsoft.build.tasks.v4.0.dll OR microsoft.build.tasks.v4.0.ni.dll
   
-  Triage: \
+  Triage:
 
-  Validate execution \
+  Validate execution
 
   1. Determine if "MSBuild.exe" executed. Validate the OriginalFileName of "MSBuild.exe" and further
   PE metadata.
-  2. Determine if script code was executed with MSBuild. \
+  2. Determine if script code was executed with MSBuild.
 
-  Situational Awareness \
+  Situational Awareness
 
   The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
   Script code by MSBuild.exe. 
@@ -40,7 +40,7 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
   MSbuild loading any suspicious .DLL's?
   3. Network connections. Any network connections? Review the reputation of the remote IP/domain.
   
-  Retrieval of script code \
+  Retrieval of script code
 
   Objective of this step is to confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk

From 50be4077f36fb7e48bb89ce997afce8f0b061489 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 12:53:47 -0700
Subject: [PATCH 43/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 ...ed_developer_utilities_proxy_execution_msbuild.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index 952b267859..fea60bc46a 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -1,4 +1,4 @@
-name: Trusted Developer Utilities Proxy Execution MSBuild
+name: Trusted developer utilities proxy execution msbuild
 id: be3418e2-551b-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-21'
@@ -18,15 +18,16 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
   The searches in this story help you detect and investigate suspicious activity that
   may indicate that an adversary is leveraging msbuild.exe to execute malicious code.
   
+    
   Default paths: c:\windows\microsoft.net\framework\v4.0.30319\, c:\windows\microsoft.net\framework64\v4.0.30319\
   OriginalFileName: msbuild.exe
   Module loads: microsoft.build.tasks.v4.0.dll OR microsoft.build.tasks.v4.0.ni.dll
   
-  Triage:
+  Triage-
 
   Validate execution
 
-  1. Determine if "MSBuild.exe" executed. Validate the OriginalFileName of "MSBuild.exe" and further
+  1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further
   PE metadata.
   2. Determine if script code was executed with MSBuild.
 
@@ -37,8 +38,8 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
 
   1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?
   2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
-  MSbuild loading any suspicious .DLL's?
-  3. Network connections. Any network connections? Review the reputation of the remote IP/domain.
+  MSbuild loading any suspicious .DLLs?
+  3. Network connections. Any network connections? Review the reputation of the remote IP or domain.
   
   Retrieval of script code
 

From 2d0e9bb7a7aa187df99f6c1b72627be41a11c220 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 12:55:44 -0700
Subject: [PATCH 44/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 stories/trusted_developer_utilities_proxy_execution_msbuild.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index fea60bc46a..89decf9391 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -1,4 +1,4 @@
-name: Trusted developer utilities proxy execution msbuild
+name: Trusted Developer Utilities Proxy Execution MSBuild
 id: be3418e2-551b-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-21'

From 5271462bb4794dc2940aba53009fbf6ce283bcf6 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 13:00:30 -0700
Subject: [PATCH 45/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 ...oper_utilities_proxy_execution_msbuild.yml | 23 +++++++------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index 89decf9391..852df17b2a 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -21,28 +21,21 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
     
   Default paths: c:\windows\microsoft.net\framework\v4.0.30319\, c:\windows\microsoft.net\framework64\v4.0.30319\
   OriginalFileName: msbuild.exe
-  Module loads: microsoft.build.tasks.v4.0.dll OR microsoft.build.tasks.v4.0.ni.dll
-  
-  Triage-
-
-  Validate execution
-
+  Module loads: microsoft.build.tasks.v4.0.dll OR microsoft.build.tasks.v4.0.ni.dll \ 
+  Triage \
+  Validate execution\
   1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further
   PE metadata.
-  2. Determine if script code was executed with MSBuild.
-
-  Situational Awareness
-
+  2. Determine if script code was executed with MSBuild. \
+  Situational Awareness\
   The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
-  Script code by MSBuild.exe. 
-
+  Script code by MSBuild.exe. \
   1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?
   2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
   MSbuild loading any suspicious .DLLs?
-  3. Network connections. Any network connections? Review the reputation of the remote IP or domain.
+  3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
   
-  Retrieval of script code
-
+  Retrieval of script code \
   Objective of this step is to confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk
 type: ESCU

From 56031c3f3ee6eb1eb5ba33123f5402488ecd13e2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 13:10:22 -0700
Subject: [PATCH 46/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 ...developer_utilities_proxy_execution_msbuild.yml | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index 852df17b2a..3f39547b58 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -18,22 +18,18 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
   The searches in this story help you detect and investigate suspicious activity that
   may indicate that an adversary is leveraging msbuild.exe to execute malicious code.
   
-    
-  Default paths: c:\windows\microsoft.net\framework\v4.0.30319\, c:\windows\microsoft.net\framework64\v4.0.30319\
-  OriginalFileName: msbuild.exe
-  Module loads: microsoft.build.tasks.v4.0.dll OR microsoft.build.tasks.v4.0.ni.dll \ 
   Triage \
   Validate execution\
-  1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further
+  - Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further
   PE metadata.
-  2. Determine if script code was executed with MSBuild. \
+  - Determine if script code was executed with MSBuild. \
   Situational Awareness\
   The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
   Script code by MSBuild.exe. \
-  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?
-  2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
+  - Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?
+  - Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
   MSbuild loading any suspicious .DLLs?
-  3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
+  - Network connections. Any network connections? Review the reputation of the remote IP or domain. \
   
   Retrieval of script code \
   Objective of this step is to confirm the executed script code is benign or malicious.'

From 306b65a6bca28e62d8a52e3af11c1462b462ccba Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 13:13:36 -0700
Subject: [PATCH 47/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 ...developer_utilities_proxy_execution_msbuild.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index 3f39547b58..c87298b19f 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -18,20 +18,20 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
   The searches in this story help you detect and investigate suspicious activity that
   may indicate that an adversary is leveraging msbuild.exe to execute malicious code.
   
-  Triage \
-  Validate execution\
+  Triage
+  Validate execution
   - Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further
   PE metadata.
-  - Determine if script code was executed with MSBuild. \
-  Situational Awareness\
+  - Determine if script code was executed with MSBuild.
+  Situational Awareness
   The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
-  Script code by MSBuild.exe. \
+  Script code by MSBuild.exe.
   - Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?
   - Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
   MSbuild loading any suspicious .DLLs?
-  - Network connections. Any network connections? Review the reputation of the remote IP or domain. \
+  - Network connections. Any network connections? Review the reputation of the remote IP or domain.
   
-  Retrieval of script code \
+  Retrieval of script code
   Objective of this step is to confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk
 type: ESCU

From 9f549140c2d2d4198e0eb2ba5d524dfea5a7b5ff Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 13:16:59 -0700
Subject: [PATCH 48/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 ...loper_utilities_proxy_execution_msbuild.yml | 18 +-----------------
 1 file changed, 1 insertion(+), 17 deletions(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index c87298b19f..fa8eba9c7f 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -16,23 +16,7 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
   that are configured to allow MSBuild.exe execution.
 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an adversary is leveraging msbuild.exe to execute malicious code.
-  
-  Triage
-  Validate execution
-  - Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further
-  PE metadata.
-  - Determine if script code was executed with MSBuild.
-  Situational Awareness
-  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
-  Script code by MSBuild.exe.
-  - Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?
-  - Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
-  MSbuild loading any suspicious .DLLs?
-  - Network connections. Any network connections? Review the reputation of the remote IP or domain.
-  
-  Retrieval of script code
-  Objective of this step is to confirm the executed script code is benign or malicious.'
+  may indicate that an adversary is leveraging msbuild.exe to execute malicious code.'
 author: Michael Haag, Splunk
 type: ESCU
 references:

From 77e720a1ad8a77727a77e528896bc9be8d481f9c Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 13:21:46 -0700
Subject: [PATCH 49/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 .../trusted_developer_utilities_proxy_execution_msbuild.yml   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index fa8eba9c7f..8f243920a4 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -7,13 +7,13 @@ description: Monitor and detect techniques used by attackers who leverage the ms
 narrative: 'Adversaries may use MSBuild to proxy execution of code through a trusted 
   Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform
   used by Visual Studio and is native to Windows. It handles XML formatted project
-  files that define requirements for loading and building various platforms and configurations.
+  files that define requirements for loading and building various platforms and configurations. \
 
   The inline task capability of MSBuild that was introduced in .NET version 4 allows
   for C# code to be inserted into an XML project file. MSBuild will compile and
   execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is
   used this way it can execute arbitrary code and bypass application control defenses
-  that are configured to allow MSBuild.exe execution.
+  that are configured to allow MSBuild.exe execution. \
 
   The searches in this story help you detect and investigate suspicious activity that
   may indicate that an adversary is leveraging msbuild.exe to execute malicious code.'

From d84f20ab5a53e6550d43439aea4db6c36c3d675a Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 13:32:41 -0700
Subject: [PATCH 50/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 ...rusted_developer_utilities_proxy_execution_msbuild.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index 8f243920a4..afcfea34ea 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -16,7 +16,13 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
   that are configured to allow MSBuild.exe execution. \
 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an adversary is leveraging msbuild.exe to execute malicious code.'
+  may indicate that an adversary is leveraging msbuild.exe to execute malicious code. \
+  
+  Triage \
+  Validate execution \
+  1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further
+  PE metadata.
+  2. Determine if script code was executed with MSBuild.'
 author: Michael Haag, Splunk
 type: ESCU
 references:

From 5708e3d999bfac41b54eaf0a38bc3da8491ff960 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 13:41:56 -0700
Subject: [PATCH 51/65] Update
 trusted_developer_utilities_proxy_execution_msbuild.yml

---
 ...ed_developer_utilities_proxy_execution_msbuild.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index afcfea34ea..355aa38376 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -22,7 +22,16 @@ narrative: 'Adversaries may use MSBuild to proxy execution of code through a tru
   Validate execution \
   1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further
   PE metadata.
-  2. Determine if script code was executed with MSBuild.'
+  2. Determine if script code was executed with MSBuild.
+  Situational Awareness \
+  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by MSBuild.exe. \
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
+  2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
+  MSbuild loading any suspicious .DLLs?
+  3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
+  Retrieval of script code \
+  The objective of this step is to confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk
 type: ESCU
 references:

From 1d1fcfc7a73509bb033205328d9832b21b04fc05 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 21 Jan 2021 14:10:42 -0700
Subject: [PATCH 52/65] Update suspicious_mshta_activity.yml

---
 stories/suspicious_mshta_activity.yml | 30 +++++++++++++++++----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/stories/suspicious_mshta_activity.yml b/stories/suspicious_mshta_activity.yml
index 774def0f77..5e5cdd30a7 100644
--- a/stories/suspicious_mshta_activity.yml
+++ b/stories/suspicious_mshta_activity.yml
@@ -5,26 +5,34 @@ date: '2021-01-20'
 description: Monitor and detect techniques used by attackers who leverage the mshta.exe
   process to execute malicious code.
 narrative: 'One common adversary tactic is to bypass application white-listing solutions
-  via the mshta.exe process, which executes Microsoft HTML applications with the .hta
-  suffix. In these cases, attackers use the trusted Windows utility to eproxy execution
+  via the mshta.exe process, which executes Microsoft HTML applications (mshtml.dll) with the .hta
+  suffix. In these cases, attackers use the trusted Windows utility to proxy execution
   of malicious files, whether an .hta application, javascript, or VBScript.\
 
-  One example of a notable mshta.exe attack was the Kovter malware (https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5)
-  that was implicated in ransomware and click-fraud attacks. Kovter utilized .hta
-  to execute a series of javascript commands, each progressively more dangerous. According
-  to the Mitre Parternship Network (https://attack.mitre.org/wiki/Technique/T1170),
-  FIN7 has leveraged mshta.exe, as has the MuddyWater group, who used it to execute
-  its POWERSTATS payload (which then used the utility to execute additional payloads).\
-
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an attacker is leveraging mshta.exe to execute malicious code.'
+  may indicate that an attacker is leveraging mshta.exe to execute malicious code. \
+  
+  Triage \
+  Validate execution \
+  1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.
+  2. Determine if script code was executed with MSHTA. \
+  Situational Awareness \
+  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by MSHTA.exe. \
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
+  2. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is
+  MSHTA loading any suspicious .DLLs?
+  3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
+  Retrieval of script code \
+  The objective of this step is to confirm the executed script code is benign or malicious.'
 author: Bhavin Patel, Michael Haag, Splunk
 type: ESCU
 references:
 - https://redcanary.com/blog/introducing-atomictestharnesses/
 - https://redcanary.com/blog/windows-registry-attacks-threat-detection/
-- https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5
 - https://attack.mitre.org/techniques/T1218/005/
+- https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5
 tags:
   analytics_story: Suspicious MSHTA Activity
   usecase: Advanced Threat Detection

From e202e6299acb6af3213b1e2a0878083e0998dc2b Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 22 Jan 2021 13:52:56 -0700
Subject: [PATCH 53/65] Adding WBAdmin - delete system backups

Deleting system backups with WBAdmin
---
 .../wbadmin_delete_system_backups.yml         | 38 +++++++++++++++++++
 .../wbadmin_delete_system_backups.test.yml    | 12 ++++++
 2 files changed, 50 insertions(+)
 create mode 100644 detections/endpoint/wbadmin_delete_system_backups.yml
 create mode 100644 tests/endpoint/wbadmin_delete_system_backups.test.yml

diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml
new file mode 100644
index 0000000000..16e01075bc
--- /dev/null
+++ b/detections/endpoint/wbadmin_delete_system_backups.yml
@@ -0,0 +1,38 @@
+name: WBAdmin Delete System Backups
+id: cd5aed7e-5cea-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-22'
+description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool)
+  that delete backup files. This is typically used by ransomware to prevent recovery.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints to populate the Endpoint
+  data model in the Processes node. Tune based on parent process names.
+type: ESCU
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+- https://thedfirreport.com/2020/10/08/ryuks-return/
+- https://attack.mitre.org/techniques/T1490/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wbadmin.exe
+  Processes.process="*delete*" AND (Processes.process="*catalog*" OR Processes.process="*systemstatebackup*") by Processes.process_name
+  Processes.process Processes.parent_process_name Processes.dest Processes.user |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wbadmin_delete_system_backups_filter`'
+known_false_positives: Administrators may modify the boot configuration.
+tags:
+  analytics_story:
+  - Ryuk Ransomware
+  - Ransomware  
+  mitre_attack_id:
+  - T1490
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.IP
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/wbadmin_delete_system_backups.test.yml b/tests/endpoint/wbadmin_delete_system_backups.test.yml
new file mode 100644
index 0000000000..6f9988cd24
--- /dev/null
+++ b/tests/endpoint/wbadmin_delete_system_backups.test.yml
@@ -0,0 +1,12 @@
+name: WBAdmin Delete System Backups Unit Test
+tests:
+- name: WBAdmin Delete System Backups
+  file: endpoint/wbadmin_delete_system_backups.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 9b1e9d7dc242e138c4076135612aba84375db796 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-94-128>
Date: Fri, 22 Jan 2021 21:23:23 +0000
Subject: [PATCH 54/65] Added detection testing service results inWBAdmin
 Delete System Backups

---
 .../endpoint/wbadmin_delete_system_backups.yml    | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml
index 16e01075bc..3999fe577e 100644
--- a/detections/endpoint/wbadmin_delete_system_backups.yml
+++ b/detections/endpoint/wbadmin_delete_system_backups.yml
@@ -2,8 +2,9 @@ name: WBAdmin Delete System Backups
 id: cd5aed7e-5cea-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-22'
-description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool)
-  that delete backup files. This is typically used by ransomware to prevent recovery.
+description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
+  Tool) that delete backup files. This is typically used by ransomware to prevent
+  recovery.
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints to populate the Endpoint
   data model in the Processes node. Tune based on parent process names.
@@ -16,14 +17,15 @@ references:
 author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wbadmin.exe
-  Processes.process="*delete*" AND (Processes.process="*catalog*" OR Processes.process="*systemstatebackup*") by Processes.process_name
-  Processes.process Processes.parent_process_name Processes.dest Processes.user |
-  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wbadmin_delete_system_backups_filter`'
+  Processes.process="*delete*" AND (Processes.process="*catalog*" OR Processes.process="*systemstatebackup*")
+  by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `wbadmin_delete_system_backups_filter`'
 known_false_positives: Administrators may modify the boot configuration.
 tags:
   analytics_story:
   - Ryuk Ransomware
-  - Ransomware  
+  - Ransomware
   mitre_attack_id:
   - T1490
   kill_chain_phases:
@@ -36,3 +38,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 2d3b98ff825905e65e2227e95842f582c9dd8a64 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 25 Jan 2021 09:09:02 -0700
Subject: [PATCH 55/65] T1482 - NLTest usage

NLTest execution to discover domain trusts.
---
 .../nltest_domain_trust_discovery.yml         | 47 +++++++++++++++++++
 .../nltest_domain_trust_discovery.test.yml    | 12 +++++
 2 files changed, 59 insertions(+)
 create mode 100644 detections/endpoint/nltest_domain_trust_discovery.yml
 create mode 100644 tests/endpoint/nltest_domain_trust_discovery.test.yml

diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml
new file mode 100644
index 0000000000..5a1caca7e1
--- /dev/null
+++ b/detections/endpoint/nltest_domain_trust_discovery.yml
@@ -0,0 +1,47 @@
+name: NLTest Domain Trust Discovery
+id: c3e05466-5f22-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-25'
+description: "This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information.
+  Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted domains. 
+  Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next."  
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md
+  - https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104
+  - https://attack.mitre.org/techniques/T1482/
+  - https://www.owasp.org/images/4/4b/Red_Team_Operating_in_a_Modern_Environment.pdf
+  - https://ss64.com/nt/nltest.html
+  - https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/
+  - https://thedfirreport.com/2020/10/08/ryuks-return/
+author: Michael Haag, Splunk
+search: '
+  | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process 
+  Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `nltest_domain_trust_discovery_filter`
+'
+known_false_positives: Administrators may use nltest for troubleshooting purposes, otherwise, rarely used.
+tags:
+  analytics_story:
+    - Ryuk Ransomware
+  mitre_attack_id:
+    - T1482
+  kill_chain_phases:
+    - Exploitation
+  cis20:
+    - CIS 8
+  nist:
+    - PR.PT
+    - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/nltest_domain_trust_discovery.test.yml b/tests/endpoint/nltest_domain_trust_discovery.test.yml
new file mode 100644
index 0000000000..92fd95983a
--- /dev/null
+++ b/tests/endpoint/nltest_domain_trust_discovery.test.yml
@@ -0,0 +1,12 @@
+name: NLTest Domain Trust Discovery
+tests:
+- name: NLTest Domain Trust Discovery
+  file: endpoint/nltest_domain_trust_discovery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 294be790dc8990be9ccaff63e53a16086a0c8fe0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 25 Jan 2021 14:28:26 -0700
Subject: [PATCH 56/65] minor updates

---
 detections/endpoint/nltest_domain_trust_discovery.yml  | 6 ++----
 tests/endpoint/suspicious_mshta_child_process.test.yml | 2 +-
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml
index 5a1caca7e1..b926da84a2 100644
--- a/detections/endpoint/nltest_domain_trust_discovery.yml
+++ b/detections/endpoint/nltest_domain_trust_discovery.yml
@@ -18,16 +18,14 @@ references:
   - https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/
   - https://thedfirreport.com/2020/10/08/ryuks-return/
 author: Michael Haag, Splunk
-search: '
-  | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
   by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process 
   Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
-  | `nltest_domain_trust_discovery_filter`
-'
+  | `nltest_domain_trust_discovery_filter`'
 known_false_positives: Administrators may use nltest for troubleshooting purposes, otherwise, rarely used.
 tags:
   analytics_story:
diff --git a/tests/endpoint/suspicious_mshta_child_process.test.yml b/tests/endpoint/suspicious_mshta_child_process.test.yml
index 859f1ca43b..48a63e4fd9 100644
--- a/tests/endpoint/suspicious_mshta_child_process.test.yml
+++ b/tests/endpoint/suspicious_mshta_child_process.test.yml
@@ -1,6 +1,6 @@
 name: Suspicious mshta child process Unit Test
 tests:
-- name: Detect mshta exe running scripts in command-line arguments
+- name: Detect mshta spawning a process
   file: endpoint/suspicious_mshta_child_process.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'

From 404f4b39000a62c0b198c93306da13df0a4fd52d Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 26 Jan 2021 06:44:33 -0700
Subject: [PATCH 57/65] Removed mshta rename

---
 tests/endpoint/detect_mshta_renamed.test.yml | 12 ------------
 1 file changed, 12 deletions(-)
 delete mode 100644 tests/endpoint/detect_mshta_renamed.test.yml

diff --git a/tests/endpoint/detect_mshta_renamed.test.yml b/tests/endpoint/detect_mshta_renamed.test.yml
deleted file mode 100644
index 7e6d69f00f..0000000000
--- a/tests/endpoint/detect_mshta_renamed.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect mshta renamed unit test
-tests:
-- name: Detect mshta renamed
-  file: endpoint/detect_mshta_rename.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file

From 720f26cc2dcbcbb418c3e3f4a28b809cf35b22bc Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-101-85>
Date: Tue, 26 Jan 2021 17:13:39 +0000
Subject: [PATCH 58/65] Added detection testing service results inNLTest Domain
 Trust Discovery

---
 .../nltest_domain_trust_discovery.yml         | 52 ++++++++++---------
 1 file changed, 27 insertions(+), 25 deletions(-)

diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml
index b926da84a2..05b3db139b 100644
--- a/detections/endpoint/nltest_domain_trust_discovery.yml
+++ b/detections/endpoint/nltest_domain_trust_discovery.yml
@@ -2,44 +2,46 @@ name: NLTest Domain Trust Discovery
 id: c3e05466-5f22-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-25'
-description: "This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information.
-  Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted domains. 
-  Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next."  
+description: This search looks for the execution of `nltest.exe` with command-line
+  arguments utilized to query for Domain Trust information. Two arguments `/domain
+  trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted
+  domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current
+  domain to assist with further understanding where to pivot next.
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
 type: ESCU
 references:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md
-  - https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104
-  - https://attack.mitre.org/techniques/T1482/
-  - https://www.owasp.org/images/4/4b/Red_Team_Operating_in_a_Modern_Environment.pdf
-  - https://ss64.com/nt/nltest.html
-  - https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/
-  - https://thedfirreport.com/2020/10/08/ryuks-return/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md
+- https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104
+- https://attack.mitre.org/techniques/T1482/
+- https://www.owasp.org/images/4/4b/Red_Team_Operating_in_a_Modern_Environment.pdf
+- https://ss64.com/nt/nltest.html
+- https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/
+- https://thedfirreport.com/2020/10/08/ryuks-return/
 author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process 
-  Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `nltest_domain_trust_discovery_filter`'
-known_false_positives: Administrators may use nltest for troubleshooting purposes, otherwise, rarely used.
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe
+  OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter`'
+known_false_positives: Administrators may use nltest for troubleshooting purposes,
+  otherwise, rarely used.
 tags:
   analytics_story:
-    - Ryuk Ransomware
+  - Ryuk Ransomware
   mitre_attack_id:
-    - T1482
+  - T1482
   kill_chain_phases:
-    - Exploitation
+  - Exploitation
   cis20:
-    - CIS 8
+  - CIS 8
   nist:
-    - PR.PT
-    - DE.CM
+  - PR.PT
+  - DE.CM
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From c42f729d2e70c01a81de769d7ea15d1dd345502b Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 26 Jan 2021 10:21:23 -0700
Subject: [PATCH 59/65] Update suspicious_mshta_child_process.test.yml

---
 tests/endpoint/suspicious_mshta_child_process.test.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/endpoint/suspicious_mshta_child_process.test.yml b/tests/endpoint/suspicious_mshta_child_process.test.yml
index 48a63e4fd9..61d477e5f9 100644
--- a/tests/endpoint/suspicious_mshta_child_process.test.yml
+++ b/tests/endpoint/suspicious_mshta_child_process.test.yml
@@ -3,10 +3,11 @@ tests:
 - name: Detect mshta spawning a process
   file: endpoint/suspicious_mshta_child_process.yml
   pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
+  earliest_time: '-7d'
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+    update_timestamp: True
\ No newline at end of file

From 8d86921ac69904c1746db1695d4cd16629a063d1 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 26 Jan 2021 10:51:38 -0700
Subject: [PATCH 60/65] Update suspicious_mshta_child_process.yml

---
 detections/endpoint/suspicious_mshta_child_process.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml
index 87c504d4bf..4f6141a49f 100644
--- a/detections/endpoint/suspicious_mshta_child_process.yml
+++ b/detections/endpoint/suspicious_mshta_child_process.yml
@@ -5,7 +5,7 @@ date: '2021-01-12'
 description: The following analytic identifies child processes spawning from  "mshta.exe". 
   The search will return the first time and last time these command-line arguments were 
   used for these executions, as well as the target system, the user, parent process
- "mshta.exe" and its child process.
+  "mshta.exe" and its child process.
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

From f0ccfd791457d7cab4cd052b82a622af2b830fb6 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 26 Jan 2021 10:56:49 -0700
Subject: [PATCH 61/65] wrong url

URL was wrong :(
---
 detections/endpoint/suspicious_mshta_child_process.yml | 2 +-
 tests/endpoint/suspicious_mshta_child_process.test.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml
index 4f6141a49f..543496e9af 100644
--- a/detections/endpoint/suspicious_mshta_child_process.yml
+++ b/detections/endpoint/suspicious_mshta_child_process.yml
@@ -42,4 +42,4 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_mshta_child_process.test.yml b/tests/endpoint/suspicious_mshta_child_process.test.yml
index 61d477e5f9..531fb31e71 100644
--- a/tests/endpoint/suspicious_mshta_child_process.test.yml
+++ b/tests/endpoint/suspicious_mshta_child_process.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
     update_timestamp: True
\ No newline at end of file

From 12ca26bd8aab530143b73753c34d6649f6d1b6ab Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-206-9>
Date: Tue, 26 Jan 2021 18:16:25 +0000
Subject: [PATCH 62/65] Added detection testing service results inDetect mshta
 spawning a process

---
 .../suspicious_mshta_child_process.yml        | 21 ++++++++++---------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml
index 543496e9af..bf483827dd 100644
--- a/detections/endpoint/suspicious_mshta_child_process.yml
+++ b/detections/endpoint/suspicious_mshta_child_process.yml
@@ -2,9 +2,9 @@ name: Suspicious mshta child process
 id: 60023bb6-5500-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
-description: The following analytic identifies child processes spawning from  "mshta.exe". 
-  The search will return the first time and last time these command-line arguments were 
-  used for these executions, as well as the target system, the user, parent process
+description: The following analytic identifies child processes spawning from  "mshta.exe".
+  The search will return the first time and last time these command-line arguments
+  were used for these executions, as well as the target system, the user, parent process
   "mshta.exe" and its child process.
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -18,13 +18,13 @@ author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=mshta.exe
-  AND (Processes.process_name=powershell.exe OR Processes.process_name=colorcpl.exe OR Processes.process_name=msbuild.exe 
-  OR Processes.process_name=microsoft.workflow.compiler.exe OR Processes.process_name=searchprotocolhost.exe
-  OR Processes.process_name=scrcons.exe OR Processes.process_name=cscript.exe
-  OR Processes.process_name=wscript.exe OR Processes.process_name=powershell.exe OR Processes.process_name=cmd.exe)
-  by Processes.dest Processes.parent_process
-  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_mshta_child_process_filter`'
+  AND (Processes.process_name=powershell.exe OR Processes.process_name=colorcpl.exe
+  OR Processes.process_name=msbuild.exe OR Processes.process_name=microsoft.workflow.compiler.exe
+  OR Processes.process_name=searchprotocolhost.exe OR Processes.process_name=scrcons.exe
+  OR Processes.process_name=cscript.exe OR Processes.process_name=wscript.exe OR Processes.process_name=powershell.exe
+  OR Processes.process_name=cmd.exe) by Processes.dest Processes.parent_process Processes.user
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `suspicious_mshta_child_process_filter`'
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 tags:
@@ -43,3 +43,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 20f29e652b1ef85e7148fdfd16ab6c04c9ac7103 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-244-66>
Date: Wed, 27 Jan 2021 10:46:06 +0000
Subject: [PATCH 63/65] Added detection testing service results inDetect
 renamed msbuild execution


From d82f9a5116c66e352e51c850768d4f886d286b62 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 27 Jan 2021 06:35:41 -0700
Subject: [PATCH 64/65] Resolved yml formatting

---
 detections/endpoint/suspicious_msbuild_path.yml   | 3 ++-
 detections/endpoint/suspicious_msbuild_rename.yml | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index 273ab01f36..71eab004a0 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -28,7 +28,8 @@ tags:
   analytics_story:
   - Trusted Developer Utilities Proxy Execution MSBuild
   mitre_attack_id:
-  - T1127.001, T1036.003
+  - T1127.001
+  - T1036.003
   kill_chain_phases:
   - Exploitation
   cis20:
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 124600c6ba..f827194f4c 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -27,7 +27,8 @@ tags:
   analytics_story:
   - Trusted Developer Utilities Proxy Execution MSBuild
   mitre_attack_id:
-  - T1127.001, T1036.003
+  - T1127.001
+  - T1036.003
   kill_chain_phases:
   - Exploitation
   cis20:

From 5b86943eb45daafbf7657e4ee587a7e7e009bee4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 27 Jan 2021 11:58:14 -0700
Subject: [PATCH 65/65] Update suspicious_msbuild_path.yml

Modified to exclude all version path. Updated false positive info and description to reflect Visual Studio usage of msbuild.
---
 detections/endpoint/suspicious_msbuild_path.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index 71eab004a0..1b99bd0d80 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -4,9 +4,9 @@ version: 1
 date: '2021-01-12'
 description: The following analytic identifies msbuild.exe executing from a non-standard
   path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319
-  and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. A moved instance of MSBuild
-  is suspicious, however there are instances of build applications that will move
-  or use a copy of MSBuild.
+  and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio will
+  run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however there
+  are instances of build applications that will move or use a copy of MSBuild.
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -18,12 +18,12 @@ author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe
-  AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v4.0.30319\\*)
+  AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v*\\*)
   by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
-known_false_positives: Some legitimate applications may use a moved copy of msbuild,
-  triggering a false positive. Baselining of MSBuild usage is recommended to better
-  understand it's path usage.
+known_false_positives: Some legitimate applications may use a moved copy of msbuild.exe,
+  triggering a false positive. Baselining of MSBuild.exe usage is recommended to better
+  understand it's path usage. Visual Studio runs an instance out of a path that will need to be filtered on.
 tags:
   analytics_story:
   - Trusted Developer Utilities Proxy Execution MSBuild